CVE-2026-90857
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit is now public and may be used.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.21%
- CWE
- CWE-434, CWE-284
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- SourceCodester College Notes Gallery Management System
Weakness type
Related vulnerabilities
- CVE-2026-56291 — Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
- CVE-2026-75949 — Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3
- CVE-2026-74803 — Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64
- CVE-2026-57827 — Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
- CVE-2026-84147 — Remote Code Execution Vulnerability in Manacle Technologies ERP System
- CVE-2026-82970 — WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability
- CVE-2026-81780 — WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
- CVE-2026-66665 — WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability