In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability.