CVE-2021-4462 is a critical (CVSS 9.8) unrestricted file upload in Employee Records System 1.0. The uploadID.php endpoint accepts files from unauthenticated users and the uploaded files can be executed. The record says Shadowserver observed exploitation on 6 February 2025. No fix is confirmed.
What's affected
Employee Records System version 1.0, per the record and VulnCheck. The record names the uploadID.php endpoint and says the application does not do proper server-side validation, so uploaded files can run.
VulnCheck's advisory says the affected version range remains undefined. I could not confirm a fixed version. The application is listed on a source code sharing site. If you downloaded it for learning or testing, do not run it on a server that is reachable from the internet.
Exploitation status: the record says exploitation evidence was observed by the Shadowserver Foundation on 6 February 2025 UTC, and VulnCheck notes it is in its KEV database. The CISA KEV flag in our record is false.
Ask where the application came from in your organisation. A copy that began as a quick prototype can quietly become the system of record for staff data. If that describes your case, treat the migration to a maintained product as part of the incident response, not a later project.
How to check if you're exposed
If you run this application, you probably know it by name. Search servers for the vulnerable file:
find /var/www -iname "uploadID.php"
Check the application folders for uploads that should not be there, especially PHP files in the upload directory:
find /var/www -path "*upload*" -name "*.php" -mtime -365
Review the web server logs for POST requests to uploadID.php from addresses you do not recognise. Because exploitation has been observed, a server that exposed this application should be treated as potentially compromised, not just as vulnerable.
If you find the application, record what data it holds before you change anything. You may need that list for a breach assessment or for notifying the people whose details are stored.
What to do now
- Take the application offline, or put it behind authentication on a private network, today.
- Search for and remove unexpected files in upload folders, and check for new accounts or scheduled tasks on the server.
- If the host was reachable from the internet, plan to rebuild it from clean media and restore data from backups taken before exposure.
- Rotate database credentials and any other secrets the web application could read.
- Do not deploy sample applications on production servers. If the data is real, move it to a maintained product.
Why it matters
The weakness is CWE-434 (Unrestricted Upload of File with Dangerous Type). The endpoint stores whatever it receives in a folder the web server can run. No login is required and no file type is checked, so a script uploaded by a stranger runs with the web server's rights.
The exploitation signal is the interesting part. The record states that Shadowserver observed exploitation evidence in February 2025, years after the CVE's original timeline. Old, simple flaws in small applications keep getting scanned for, because they are cheap to find and the targets are rarely patched.
An application that stores employee data adds a privacy angle: a compromise here can expose personal records. That raises the cost of the compromise beyond the server itself.
Quick check
Is this exploited?
The record states that Shadowserver observed exploitation evidence on 2025-02-06, and VulnCheck lists it in its KEV database. It is not flagged in CISA KEV.
Is there a patched version?
No fixed version is confirmed. Treat the application as unsafe for internet exposure.
Sources
Last reviewed: 19 October 2026.
