CVE-2026-91005

MediumCVSS 6.3

Published: 15/09/2026(UTC)Updated: 17/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0 in the move_uploaded_file function of production/edit_picture.php in the Profile Picture Upload component. Manipulating the File argument results in unrestricted file upload. The attack can be carried out remotely and a public exploit is available.

Risk Assessment

A remote attacker could upload arbitrary files, including malicious scripts, potentially leading to server compromise. The public availability of the exploit increases the risk.

Recommendation

Restrict allowed file types and review the move_uploaded_file implementation. Consider upgrading or discontinuing the vulnerable version of the system.

Other vulnerabilities in SourceCodester Online Faculty Clearance System

CVE-2026-91004High
In SourceCodester Online Faculty Clearance System 1.0, a SQL injection vulnerability exists in an unknown function of the file /delete_faculty1.php, through manipulation of the ID argument. The attack can be executed remotely, and the exploit has been disclosed publicly.

Original NVD description (English source)

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS