PT-2025-41748 · Unknown · Projectsandprograms School Management System

Qqy-123 + 1 · Publicado 2025-10-13 · Atualizado 2025-10-18 · CVE-2025-11659

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjectsAndPrograms School Management System versions prior to 6b6fae5426044f89c08d0dd101c7fa71f9042a59

Description A security issue exists in ProjectsAndPrograms School Management System related to unrestricted file upload. This is due to insufficient validation of the File argument within the /assets/uploadNotes.php functionality. This allows remote attackers to upload malicious files. The exploit for this issue has been published.

Recommendations Update ProjectsAndPrograms School Management System to version 6b6fae5426044f89c08d0dd101c7fa71f9042a59 or later.

Exploit

Correção

Unrestricted File Upload

Improper Access Control

Enumeração de Fraquezas

CWE-434

CWE-284

Identificadores relacionados

CVE-2025-11659

Produtos afetados

Projectsandprograms School Management System

Referências · 15

• 🔥 https://github.com/qqy-123/cve/issues/4 · Exploit
• https://t.me/cveNotify/138411 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1977585005913104811 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1977600821291368500 · Publicação no Twitter
• https://vuldb.com/?ctiid.328076 · Nota
• https://t.me/CVEtracker/34739 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-11659 · Aviso do Fabricante
• https://t.me/cveNotify/139048 · Publicação no Telegram
• https://vuldb.com/?id.328076 · Nota
• https://twitter.com/RedPacketSec/status/1977596917124075810 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-11659 · Nota de Segurança
• https://vuldb.com/?submit.665609 · Nota
• https://twitter.com/cracbot/status/1979140389396238416 · Publicação no Twitter
• https://twitter.com/CveTodo/status/1977592669443411987 · Publicação no Twitter
• https://twitter.com/cracbot/status/1979502771788218448 · Publicação no Twitter