CVE-2026-91005

2.1 lowEPSS 0.4%

Low (2.1). EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWEs: CWE-284, CWE-434
Published: 2026-09-15
Modified: 2026-09-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/zzjzzzj389/cve/issues/1
https://vuldb.com/cve/CVE-2026-91005
https://vuldb.com/submit/932334
https://vuldb.com/vuln/403588
https://vuldb.com/vuln/403588/cti

Check your stack JSON