Visitor Management System 1.0 by sanjay1313 contains an unrestricted file upload vulnerability in admin_user_insert.php and update_1.php files. The move_uploaded_file() function lacks proper validation for MIME type, extension, or content. Authenticated administrators can exploit this weakness to upload PHP webshells. Successful exploitation leads to remote code execution on the affected server. The vulnerability affects two specific PHP files in the VMS application.