CVE-2025-11659 MEDIUM

CVE-2025-11659: ProjectsAndPrograms School Management System uploadNotes.php unrestricted upload

Vendor Projectsandprograms
Product School Management System
Weakness CWE-434 · Unrestricted file upload
Published October 13, 2025
Last update October 14, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

Key dates

02Disclosure timeline

October 13, 2025 CVE published
October 14, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-40772 WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability CVE-2026-13553 itsourcecode Online Hotel Management System controller.php add unrestricted upload CVE-2026-13547 Hanwang e-Face General Management Platform upload.do unrestricted upload CVE-2026-6933 Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation CVE-2026-11344 code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload