CVE-2023-3187

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231176.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-318717.8OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root CVE-2023-318737.8Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').CVE-2023-318748.8Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').CVE-2023-31886.5Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.CVE-2023-318895.5An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a d CVE-2023-31896.1A vulnerability, which was classified as problematic, was found in SourceCodester Online School Fees System 1.0. This affects an unknown par CVE-2023-318909.8An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() p CVE-2023-318937.5Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.CVE-2023-31904.6Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-319029.8RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).CVE-2023-319039.8GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.CVE-2023-319047.5savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion.