CVE-2026-5670mediumCWE-284CWE-434

CVE-2026-5670: falha de média gravidade em Cyber-III Student-Management-System

Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Student-Management-System

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 5.3epss 0.2%
A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/upload.php. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Cyber-III · Student-Management-System
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Cyber-III Student-Management-System

No mesmo produto, das mais perigosas para as menos.

CVE-2026-5671MEDIUMCyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php cross site scriptingEPSS 0.3%CVE-2026-5642MEDIUMCyber-III Student-Management-System HTTP POST Request update.php improper authorizationEPSS 0.3%CVE-2026-5669MEDIUMCyber-III Student-Management-System Parameter login.php sql injectionEPSS 0.3%CVE-2026-5668MEDIUMCyber-III Student-Management-System add%20notice.php cross site scriptingEPSS 0.2%CVE-2026-5644MEDIUMCyber-III Student-Management-System batch-notice.php cross site scriptingEPSS 0.2%CVE-2026-5643MEDIUMCyber-III Student-Management-System Admin Add Endpoint notice.php cross site scriptingEPSS 0.2%