CVE-2026-5670

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5670", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-06T08:14:09.694Z", "datePublished": "2026-04-06T16:45:11.611Z", "dateUpdated": "2026-04-07T14:23:09.397Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T16:45:11.611Z"}, "title": "Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "Unrestricted Upload"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "Cyber-III", "product": "Student-Management-System", "versions": [{"version": "1a938fa61e9f735078e9b291d2e6215b4942af3f", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/upload.php. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-06T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-06T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-06T10:19:24.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Lier (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/355492", "name": "VDB-355492 | Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/355492/cti", "name": "VDB-355492 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/786022", "name": "Submit #786022 | Cyber-III Student-Management-System 1.0 RCE vulnerability", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Cyber-III/Student-Management-System/issues/241", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Cyber-III/Student-Management-System/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T14:22:48.676901Z", "id": "CVE-2026-5670", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:23:09.397Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5670", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T14:22:48.676901Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:23:04.738Z"}}], "cna": {"title": "Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload", "credits": [{"lang": "en", "type": "reporter", "value": "Lier (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Cyber-III", "product": "Student-Management-System", "versions": [{"status": "affected", "version": "1a938fa61e9f735078e9b291d2e6215b4942af3f"}]}], "timeline": [{"lang": "en", "time": "2026-04-06T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-06T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-06T10:19:24.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355492", "name": "VDB-355492 | Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/355492/cti", "name": "VDB-355492 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/786022", "name": "Submit #786022 | Cyber-III Student-Management-System 1.0 RCE vulnerability", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Cyber-III/Student-Management-System/issues/241", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Cyber-III/Student-Management-System/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/upload.php. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T16:45:11.611Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5670", "state": "PUBLISHED", "dateUpdated": "2026-04-07T14:23:09.397Z", "dateReserved": "2026-04-06T08:14:09.694Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-06T16:45:11.611Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Student-Management-System", "vendor": "Cyber-III", "versions": [{"status": "affected", "version": "1a938fa61e9f735078e9b291d2e6215b4942af3f"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/upload.php. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "pendiente..."}], "id": "CVE-2026-5670", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5670", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T14:22:48.676901Z", "version": "2.0.3"}}]}, "published": "2026-04-06T17:17:15.470", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Cyber-III/Student-Management-System/"}, {"source": "cna@vuldb.com", "url": "https://github.com/Cyber-III/Student-Management-System/issues/241"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/786022"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355492"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355492/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-434"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1a938fa61e9f735078e9b291d2e6215b4942af3f"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "student-management-system", "vendor": "cyber-iii"}], "analysis": {"en": {"generated_at": "2026-04-06T22:35:28.988132+00:00", "value": {"mitigation_remediation": ["Apply a vendor patch as soon as it is released by Cyber\u2011III", "Restrict the upload functionality to authenticated and authorized users only", "Validate the MIME type, file extension, and file size before calling move_uploaded_file", "Configure the upload directory with restrictive permissions so that uploaded files cannot be executed", "Continuously monitor upload logs and file system for unauthorized or suspicious file uploads", "Review the project's issue tracker regularly for updates or potential temporary fixes"], "summary": {"action": "Patch ASAP", "impact": "Unrestricted File Upload"}, "threat_synthesis": {"affected_systems": "The affected product is Cyber\u2011III Student\u2011Management\u2011System. No specific version information is available from the CVE; the issue was reported against the code base as of the identifier 1a938fa61e9f735078e9b291d2e6215b4942af3f, but no repaired release has been published. Therefore, all deployments of the system that have not been manually patched or upgraded are potentially vulnerable.", "description_and_impact": "The vulnerability originates from an unvalidated use of the PHP function move_uploaded_file within upload.php. An attacker can supply malicious file content via the File argument, bypassing any checks on MIME type, extension, or size. This flaw falls under CWE\u2011284 (Improper Control of Access Permissions) and CWE\u2011434 (Unrestricted Upload of File with Dangerous Type). If an attacker uploads a file that the web server can execute\u2014such as a PHP script\u2014this could lead to arbitrary code execution, data tampering, or denial of service of the application.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate risk, and the vulnerability is not listed in the CISA KEV catalog. It is explicitly stated that the attack can be initiated remotely through the web interface, implying that remote attackers can exploit the flaw by crafting a request to upload a file. The lack of file validation and the write permission of the upload directory give an attacker the ability to place arbitrary files on the server. If the upload directory is web\u2011exposed or executable, the attacker could execute code, thereby compromising confidentiality, integrity, and availability of the application. The EPSS score is not available, but the publicly released exploit suggests a realistic likelihood of exploitation."}}}}, "created": "2026-04-07T06:54:56.443340+00:00", "updated": "2026-04-07T09:39:16.131852+00:00", "vendors": ["cyber-iii", "cyber-iii$PRODUCT$student-management-system"]}