Riskcovery

CVE-2026-18927

imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload

State
Published
Severity
5.3 Medium
Published
Aug 5, 2026
Updated
Aug 5, 2026
Reserved
Aug 5, 2026

Read the record on cve.org

Description

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file student_profile_pic.php of the component Shared Upload Helper. Executing a manipulation of the argument choose_file can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
3.06.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
2.06.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:URVulDB

Weaknesses

Affected Products

ProductVersions
Student-Management-Systemimranrisal-dev
  • 18ea7904c339e0c7b0234724a79c939ce6191defAffected
  • a8d43a29aaf267e7ca97171d6dbb44057bcd7f8cAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.