CVE-2026-90857
MediumCVSS 6.3Summary
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. It affects an unknown function in /dashboard/userprofile.php of the Profile Upload component. Manipulation of the image argument results in unrestricted upload. The attack can be initiated remotely, and the exploit is public.
Risk Assessment
An attacker could upload malicious files, potentially leading to code execution on the server or system takeover.
Recommendation
Implement file type validation and restrict permissions on the upload directory. Also, apply vendor patches.
Other vulnerabilities in SourceCodester College Notes Gallery Management System
See all- CVE-2026-90856High
A vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. It affects an unknown function in the signup.php file of the Registration Flow component. Manipulation of the role argument leads to improper privilege management. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-90849High
A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. It affects an unknown functionality in the /College/login.php file. Manipulation of the User argument leads to SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit is now public and may be used.