CVE-2026-0547

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0547", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-01T13:21:45.563Z", "datePublished": "2026-01-02T09:32:07.601Z", "dateUpdated": "2026-02-23T08:08:25.076Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:08:25.076Z"}, "title": "PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "Unrestricted Upload"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "PHPGurukul", "product": "Online Course Registration", "versions": [{"version": "3.0", "status": "affected"}, {"version": "3.1", "status": "affected"}], "cpes": ["cpe:2.3:a:phpgurukul:online_course_registration:*:*:*:*:*:*:*:*"], "modules": ["Student Registration Page"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profile.php of the component Student Registration Page. The manipulation of the argument photo results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-01T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-15T07:34:57.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "hackerfactory (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.339355", "name": "VDB-339355 | PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.339355", "name": "VDB-339355 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.728988", "name": "Submit #728988 | PHPGurukul Online Course Registration v3.1 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/rsecroot/Online-Course-Registration/blob/main/Cross%20Site%20Scripting.md", "tags": ["exploit"]}, {"url": "https://phpgurukul.com/", "tags": ["product"]}], "tags": ["x_freeware"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-02T14:15:38.067840Z", "id": "CVE-2026-0547", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T21:50:05.776Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0547", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-02T14:15:38.067840Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-02T14:15:44.955Z"}}], "cna": {"tags": ["x_freeware"], "title": "PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload", "credits": [{"lang": "en", "type": "reporter", "value": "hackerfactory (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:phpgurukul:online_course_registration:*:*:*:*:*:*:*:*"], "vendor": "PHPGurukul", "modules": ["Student Registration Page"], "product": "Online Course Registration", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}]}], "timeline": [{"lang": "en", "time": "2026-01-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-01T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-15T07:34:57.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.339355", "name": "VDB-339355 | PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.339355", "name": "VDB-339355 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.728988", "name": "Submit #728988 | PHPGurukul Online Course Registration v3.1 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/rsecroot/Online-Course-Registration/blob/main/Cross%20Site%20Scripting.md", "tags": ["exploit"]}, {"url": "https://phpgurukul.com/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profile.php of the component Student Registration Page. The manipulation of the argument photo results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:08:25.076Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0547", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:08:25.076Z", "dateReserved": "2026-01-01T13:21:45.563Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-02T09:32:07.601Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:phpgurukul:online_course_registration:*:*:*:*:*:*:*:*"], "modules": ["Student Registration Page"], "product": "Online Course Registration", "vendor": "PHPGurukul", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpgurukul:online_course_registration:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1AC601F-C851-49CE-B60E-B8A662293ED3", "versionEndIncluding": "3.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profile.php of the component Student Registration Page. The manipulation of the argument photo results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en PHPGurukul Online Course Registration hasta la versi\u00f3n 3.1. Este problema afecta a alg\u00fan procesamiento desconocido del archivo /admin/edit-student-profile.php del componente P\u00e1gina de Registro de Estudiantes. La manipulaci\u00f3n del argumento photo resulta en carga sin restricciones. El ataque puede ser lanzado remotamente. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado."}], "id": "CVE-2026-0547", "lastModified": "2026-06-17T10:10:55.670", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0547", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-02T14:15:38.067840Z", "version": "2.0.3"}}]}, "published": "2026-01-02T10:15:41.510", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/rsecroot/Online-Course-Registration/blob/main/Cross%20Site%20Scripting.md"}, {"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://phpgurukul.com/"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.339355"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.339355"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.728988"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-434"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T08:35:12.716040+00:00", "value": {"mitigation_remediation": ["Upgrade PHPGurukul Online Course Registration to the latest version that removes the unrestricted upload flaw, or apply any available vendor patch for versions up to 3.1.", "Configure the upload directory so that the web server cannot execute files from it; restrict write permissions to only the upload controller and serve uploaded files through a dedicated, non\u2011executable directory.", "Validate uploaded files rigorously by checking MIME type, file signature, and extensions; reject non\u2011image files and store uploads outside the web root if possible.", "Restrict access to the /admin path by requiring authentication or by blocking anonymous access to edit\u2011student\u2011profile.php, reducing the surface for malicious uploads."], "summary": {"action": "Patch", "impact": "Arbitrary File Upload"}, "threat_synthesis": {"affected_systems": "Affected products are PHPGurukul Online Course Registration applications that include the Student Registration module. Any installation using versions up to and including 3.1 is potentially vulnerable. The issue originates from the photo argument in /admin/edit\u2011student\u2011profile.php. No additional version qualifiers are available beyond the upper bound of 3.1; therefore any deployment within this range should be examined.", "description_and_impact": "A vulnerability has been discovered in PHPGurukul Online Course Registration up to version 3.1. The flaw resides in the Student Registration component, specifically the edit\u2011student\u2011profile.php script. An attacker can supply a specially crafted photo argument that bypasses the application\u2019s file validation logic, allowing the attacker to upload any file type to the server. If the upload is executed in a writable directory that is served by the web server, this enables the attacker to place malicious payloads, potentially leading to remote code execution or further compromise.", "risk_and_exploitability": "The CVSS score of 5.3 reflects moderate impact but the presence of an unrestricted upload elevates the risk when an attacker can supply a web\u2011accessible persistence script. The EPSS indicates a very low exploitation probability (<1%) at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Despite the low prevalence, the attack can be launched remotely without prior authentication, so an attacker could upload a file that, if executed by the server, would give the attacker control over the application. The exploit is publicized on multiple forums and code repositories, so detection of such uploads should be part of security monitoring."}}}}, "created": "2026-01-05T10:14:10.659973+00:00", "updated": "2026-04-18T08:45:41.400249+00:00", "vendors": ["phpgurukul", "phpgurukul$PRODUCT$online_course_registration"]}