Is CVE-2026-122047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122047 being exploited in the wild.

How severe is CVE-2026-122047?

High severity, with a CVSS score of 7.3, published 4 November 2026.

How is CVE-2026-122047 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-122047?

Check whether you run Campcodes Complete Advance Loan Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122047: Campcodes Complete Advance Loan Management System unrestricted file upload

CVE-2026-122047 · Severity: high · CVSS 7.3 · Published 2026-11-04

Campcodes Complete Advance Loan Management System is a web-based loan management platform. An unauthenticated attacker can upload arbitrary PHP files to the banner upload function and execute them, allowing complete remote control of the server. No authentication is required and the vulnerability is trivial to exploit.

Vendors: Campcodes.

Quick answers

Is CVE-2026-122047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122047 being exploited in the wild.
How severe is CVE-2026-122047?: High severity, with a CVSS score of 7.3, published 4 November 2026.
Which products and versions are affected?: Campcodes Complete Advance Loan Management System 1.0.
Is there a fix for CVE-2026-122047?: No fixed version is recorded yet. Enforce server-side authentication with an exit statement after the session guard redirect in config/session.php, implement extension and MIME-type allowlists for uploads, rename uploaded files to random names, and deny script execution in the upload directory via web server configuration. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-122047 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-122047?: Check whether you run Campcodes Complete Advance Loan Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Enforce server-side authentication with an exit statement after the session guard redirect in config/session.php, implement extension and MIME-type allowlists for uploads, rename uploaded files to random names, and deny script execution in the upload directory via web server configuration.

Technical details

The vulnerability exists in /loan/application/banner.php, where the move_uploaded_file() function writes user-supplied files to a web-accessible directory with no extension validation, file type checking, or authentication enforcement (the session guard is JavaScript-only with no server-side exit). An unauthenticated remote attacker can POST a PHP webshell to the upload endpoint and execute it by accessing the file in the bannar/ directory, achieving arbitrary code execution.

Affected products

Campcodes Complete Advance Loan Management System 1.0

Timeline

2026-09-26: disclosed: Vulnerability discovered and validated in lab; advisory drafted but not sent to vendor
2026-11-04: advisory: Public disclosure via TraceX Labs and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.