EUVD-2026-34835
GHSA-qgpw-6v3f-gh8q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. The impacted element is an unknown function of the file dashboard_page/forms/upload_student_data.php of the component Student Data Upload Endpoint. Such manipulation of the argument Student-Data-CSV leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unrestricted file upload in tittuvarghese CollegeManagementSystem exposes the Student Data Upload endpoint (dashboard_page/forms/upload_student_data.php) to remote exploitation by authenticated low-privilege users, allowing arbitrary file types - including PHP web shells - to be uploaded to the server by manipulating the Student-Data-CSV argument. All deployed instances across all commits are affected given the project's rolling release model, and no vendor-released patch exists as the maintainer has not responded to responsible disclosure. Publicly available exploit code exists, raising real-world risk above what the CVSS 6.3 score alone implies.
Technical ContextAI
The affected product is a PHP-based web application for managing college operations, identified by CPE cpe:2.3:a:tittuvarghese:collegemanagementsystem:*:*:*:*:*:*:*:*. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the endpoint dashboard_page/forms/upload_student_data.php processes the Student-Data-CSV multipart form parameter without enforcing any server-side validation of the uploaded file's content type, extension, or MIME signature. In PHP environments, this class of flaw is critical because the web server can execute uploaded .php files directly if they land in a web-accessible directory, enabling immediate remote code execution via a deposited web shell. The specific vulnerable commits are 3e476335cfbfb9a049e09f474c7ec885f69a9df3 and a38852979f7e27ae67b610dce5979500ef8ebe01, as reported by VulDB.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the responsible disclosure filed at https://github.com/tittuvarghese/CollegeManagementSystem/issues/2. Deploying institutions should immediately implement server-side file type validation on the dashboard_page/forms/upload_student_data.php endpoint, restricting accepted files to CSV MIME type (text/csv) and rejecting any submission with executable extensions - this directly addresses the CWE-434 root cause. As a compensating control, configure the web server to disable PHP execution within the upload storage directory using an .htaccess directive (php_flag engine off) for Apache or a location block with fastcgi_pass restrictions for Nginx, which neutralizes web shell payloads even if uploaded successfully; note this may break legitimate server-side processing of that directory. Additionally, restrict access to the upload endpoint via IP allowlist or network segmentation to trusted administrative hosts only, reducing the attack surface created by the PR:L authentication requirement. If the upload feature is non-essential for ongoing operations, disabling it entirely is the lowest-risk mitigation until a patch is available.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today