CVE-2026-6489

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This issue affects some unknown processing of the file admin/addteacher.php of the component Background Management Page. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-648926.3- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This CVE-2026-648937.3- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issu CVE-2026-648965.2Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Co CVE-2026-648975.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-648987.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-648995.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-64907.3A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file CVE-2026-649005.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-649018.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-649025.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-649037.8Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-649047.8Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.