CVE-2026-5670
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Cyber-III Student-Management-System, the move_uploaded_file function in /AssignmentSection/submission/upload.php allows unrestricted file upload via manipulation of the File argument. The attack can be initiated remotely and a public exploit is already available.
Risk Assessment
Unrestricted file upload can enable remote code execution or upload of malicious files, leading to system compromise.
Recommendation
Implement validation of file type and size and restrict access to the upload functionality. Consider applying patches or security workarounds until an official update is released.
Other vulnerabilities in Cyber-III Student-Management-System
See all- CVE-2026-5671Medium
The Cyber-III Student-Management-System has an XSS vulnerability in the file /admin/class%20schedule/delete_batch.php. Manipulation of the batch argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-5668Low
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/upload.php. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS