PT-2026-33450 · Unknown · Querymine Sms

Mofeifei · Published 2026-04-17 · Updated 2026-04-19 · CVE-2026-6489

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QueryMine sms (affected versions not specified)

Description An unrestricted file upload flaw exists in the Background Management Page component. The issue occurs during the processing of the file 'admin/addteacher.php' when the image argument is manipulated, allowing a remote attacker to upload files without restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2026-6489

Affected Products

Querymine Sms

References · 7

• 🔥 https://github.com/duckpigdog/CVE/blob/main/QueryMine_sms%20PHP%20Project%20Deployment%20Document%20(Windows%20Local)-3.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6489 · Security Note
• https://vuldb.com/vuln/358033 · Note
• https://vuldb.com/submit/786981 · Note
• https://twitter.com/CVEnew/status/2045889742890291309 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045147951282958360 · Twitter Post
• https://vuldb.com/vuln/358033/cti · Note