EUVD-2026-19398
GHSA-2x66-2279-rwjv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/upload.php. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unrestricted file upload in Cyber-III Student-Management-System allows authenticated remote attackers to upload arbitrary files via manipulation of the File parameter in /AssignmentSection/submission/upload.php, leading to potential remote code execution or data exfiltration. The vulnerability affects the move_uploaded_file function and has publicly available exploit code; the vendor has not responded to early disclosure notification. CVSS 5.3 reflects low confidentiality and integrity impact within an authenticated context, though real-world risk depends on file execution permissions and web server configuration.
Technical ContextAI
The vulnerability exists in a PHP-based student management system where the upload.php script handles assignment submissions. The root cause is improper input validation on the File parameter before invoking the move_uploaded_file() function, classified under CWE-284 (Improper Access Control). While move_uploaded_file() provides some protection against overwriting existing files and requires valid uploaded file resources, the vulnerability indicates that the application fails to enforce whitelist-based file type or extension validation, allowing attackers to upload files with arbitrary names or types. The attack vector is network-accessible (AV:N) and requires low privilege (PR:L), suggesting the application enforces basic authentication but lacks fine-grained authorization controls on upload operations.
RemediationAI
Implement strict server-side file upload validation: (1) whitelist allowed file extensions (e.g., .pdf, .docx, .zip) and reject all others before invoking move_uploaded_file(); (2) validate MIME type using server-side inspection (not client-provided headers) via functions like mime_content_type() or finfo_file(); (3) store uploaded files outside the web root or in a non-executable directory with appropriate file permissions (e.g., chmod 644 on Linux); (4) rename uploaded files to a random identifier, stripping original filenames; (5) implement Content-Disposition: attachment headers when serving files to prevent browser execution. Since the vendor has not released a patched version, apply these controls directly to the codebase at /AssignmentSection/submission/upload.php. For institutional deployments, consider disabling PHP execution in the upload directory via web server configuration (e.g., .htaccess or nginx config). Monitor the project's GitHub repository and issue #241 for vendor updates; if no response is received within a reasonable timeframe, consider forking or switching to an actively maintained alternative.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-284 – Improper Access Control
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today