Product
Visitor Management System 1.0 is vulnerable to a critical attack chain where SQL injection in 'pass.php' leads to plaintext credential theft and subsequent unrestricted file upload in 'admin_user_0.php' for remote code execution.