PT-2025-41746

CVE-2025-11657

Published

2025-10-13

Updated

2026-10-08

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjectsAndPrograms School Management System versions prior to 6b6fae5426044f89c08d0dd101c7fa71f9042a59

Description A security flaw exists in ProjectsAndPrograms School Management System that allows unrestricted file upload. The issue is located in the /assets/createNotice.php script, specifically in the handling of the File argument. This allows a remote attacker to upload malicious files. The exploit has been publicly disclosed.

Recommendations Update ProjectsAndPrograms School Management System to a version later than 6b6fae5426044f89c08d0dd101c7fa71f9042a59.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-434: Unrestricted Upload of File with Dangerous Type

Related identifiers