College Notes Gallery
Monthly
Arbitrary file upload in College-Notes-Gallery (rolling release up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6) lets authenticated remote attackers manipulate the 'image' parameter at /dashboard/userprofile.php?section=admin1 to bypass intended file-type restrictions and store arbitrary files on the server. Publicly available exploit code exists, but there is no KEV confirmation in the provided data, and the vendor did not issue a patch. The independent assessment rates this as a low real-world priority because valid credentials are required, the project is obscure with a tiny install base, and no official fix exists; the resulting impact can nevertheless be high if uploaded files are web-accessible and executable.
A vulnerability has been found in code-projects College Notes Gallery 2.0 and classified as critical. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary file upload in College-Notes-Gallery (rolling release up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6) lets authenticated remote attackers manipulate the 'image' parameter at /dashboard/userprofile.php?section=admin1 to bypass intended file-type restrictions and store arbitrary files on the server. Publicly available exploit code exists, but there is no KEV confirmation in the provided data, and the vendor did not issue a patch. The independent assessment rates this as a low real-world priority because valid credentials are required, the project is obscure with a tiny install base, and no official fix exists; the resulting impact can nevertheless be high if uploaded files are web-accessible and executable.
A vulnerability has been found in code-projects College Notes Gallery 2.0 and classified as critical. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.