CVE-2026-91005

MediumCVSS 6.3/10Last modified Sep 17, 2026

Description

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Online Faculty Clearance System	1.0

References

Timeline

Published: Sep 15, 2026
Last modified: Sep 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-910068.8Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concaten CVE-2026-910077.8The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before co CVE-2026-910083.7The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before renderi CVE-2026-910094.3The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in som CVE-2026-91014.3Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal afte CVE-2026-910104.3The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities CVE-2026-910116.8The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowin CVE-2026-910129.8org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell comman CVE-2026-910139.3Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scri CVE-2026-910147.1The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before r CVE-2026-910155.3The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates i CVE-2026-910165.3The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before retu