CVE-2023-41505

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-415069.8An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackCVE-2023-415079.8Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, diCVE-2023-415089.8A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel.CVE-2023-41516.1The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-415196.1Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter aCVE-2023-41527.5Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of theCVE-2023-415208.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the clasCVE-2023-415218.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the idCVE-2023-415228.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, fCVE-2023-415238.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClasCVE-2023-415248.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.CVE-2023-415259.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php