CVE-2024-0783 is a medium severity (CVSS 6.3) unrestricted file upload in Project Worlds Online Admission System 1.0, in documents.php, reachable remotely. The record names no fixed version and a public exploit exists. Remove the upload feature or the application from any internet facing host.
What's affected
Project Worlds Online Admission System 1.0. The vulnerable file is documents.php. The record says manipulation leads to unrestricted upload, the attack may be started remotely, and an exploit has been disclosed to the public.
No fixed version is in the record. This kind of project is usually distributed as source code to learn from, so the practical fix is changing the code you run.
The record classifies the weakness as CWE-434 (unrestricted upload of dangerous file types). NVD scores it 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
The sources differ on severity. The description, from VulDB, calls the issue critical. NVD's CVSS 3.1 score is 6.3 (Medium). Remote file upload that can lead to code execution is serious on an exposed server, so the lower number should not make you relax.
How to check if you're exposed
There is no package manager command that answers this one, because the record points to a standalone application or a product that publishes no version history. Start with an inventory question: do you run Online Admission System anywhere, including test servers, lab machines and forgotten demo installs?
If you build software from source, search your repositories and artifact stores for the project name. The free in-browser dependency scan can flag known issues in the dependencies it finds, which helps when the component is vendored or pulled in transitively.
What to do now
- Find out whether this application runs anywhere, including test and student projects hosted on shared servers.
- Take it off the internet or behind authentication and a VPN until the upload handler is fixed.
- In the code, allow only specific file extensions and content types, store uploads outside the web root, and rename files on save.
- Check the upload folder for files that are not documents, and review web server logs for requests to them.
Why it matters
Unrestricted upload (CWE-434) lets a user put a file on the server that the server may later run. If the upload folder is inside the web root and the server executes scripts there, a file can become code execution.
The fix pattern is well known and does not depend on a vendor patch: validate type, rename the file, and store it where scripts do not run.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Why does the title say Medium when the description says critical?
Two sources rate it differently. NVD scores it 6.3 (Medium). The VulDB description uses the word critical. Both are noted here.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
