PT-2025-41748 · Unknown · Projectsandprograms School Management System

Qqy-123 + 1 · Published 2025-10-13 · Updated 2025-10-18 · CVE-2025-11659

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjectsAndPrograms School Management System versions prior to 6b6fae5426044f89c08d0dd101c7fa71f9042a59

Description A security issue exists in ProjectsAndPrograms School Management System related to unrestricted file upload. This is due to insufficient validation of the File argument within the /assets/uploadNotes.php functionality. This allows remote attackers to upload malicious files. The exploit for this issue has been published.

Recommendations Update ProjectsAndPrograms School Management System to version 6b6fae5426044f89c08d0dd101c7fa71f9042a59 or later.

Exploit

Fix

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2025-11659

Affected Products

Projectsandprograms School Management System

References · 15

• 🔥 https://github.com/qqy-123/cve/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2025-11659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11659 · Security Note
• https://t.me/cveNotify/138411 · Telegram Post
• https://twitter.com/CVEnew/status/1977585005913104811 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1977600821291368500 · Twitter Post
• https://vuldb.com/?ctiid.328076 · Note
• https://t.me/CVEtracker/34739 · Telegram Post
• https://t.me/cveNotify/139048 · Telegram Post
• https://vuldb.com/?id.328076 · Note
• https://twitter.com/RedPacketSec/status/1977596917124075810 · Twitter Post
• https://vuldb.com/?submit.665609 · Note
• https://twitter.com/cracbot/status/1979140389396238416 · Twitter Post
• https://twitter.com/CveTodo/status/1977592669443411987 · Twitter Post
• https://twitter.com/cracbot/status/1979502771788218448 · Twitter Post