EUVD-2026-35005
GHSA-cm8c-634g-crq2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected is an unknown function of the file service/RegisterService.php of the component Registration Endpoint. Performing a manipulation of the argument stimg results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unrestricted file upload in Kushan2k's student-management-system exposes the registration endpoint to unauthenticated remote attackers who can upload arbitrary files - including PHP webshells - by manipulating the stimg argument in service/RegisterService.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required, making this trivially exploitable by any network-reachable attacker. Publicly available exploit code exists (E:P confirmed), and the vendor has not responded to responsible disclosure as of analysis time, leaving all installations unpatched.
Technical ContextAI
The affected product is a PHP-based student management system identified by CPE cpe:2.3:a:kushan2k:student-management-system:*:*:*:*:*:*:*:*, developed under a rolling-release model. The vulnerability resides in service/RegisterService.php, which handles student registration and accepts a file parameter stimg - almost certainly intended for uploading a student profile image. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes a server-side failure to validate the content-type, file extension, or magic bytes of an uploaded file before writing it to the filesystem. In a PHP application context, this is a critical class of flaw because an uploaded .php file stored in a web-accessible directory can be directly requested and executed by the web server, turning a file upload into arbitrary remote code execution. The rolling-release model means no discrete patched version number exists, and all deployments based on commits up to and including f16a4ceaddd6729c4b306ed4641cda3176c1ef2a are affected.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the responsible disclosure filed via GitHub issue (https://github.com/Kushan2k/student-management-system/issues/1). Organizations running this software should apply the following specific compensating controls immediately: first, disable the public registration endpoint entirely if self-registration is not operationally required, which eliminates the attack surface at zero functional cost for managed deployments. Second, if the endpoint must remain active, implement a Web Application Firewall rule to block multipart file uploads to RegisterService.php that contain PHP-executable extensions (.php, .php3, .php5, .phtml, .phar). Third, configure the upload destination directory with noexec permissions and ensure it is not served directly by the web server, preventing execution of already-uploaded files - note this is a mitigation not a fix, as the upload itself may still succeed. Fourth, restrict access to the registration endpoint by IP allowlist if only known users register. Administrators should monitor the upload directory for unexpected PHP files as an indicator of prior exploitation. Pull the latest commit from https://github.com/Kushan2k/student-management-system periodically and review for a fix to RegisterService.php.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today