{"id":"CVE-2025-70151","title":"code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload","summary":"code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-acce…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"vendor":"fabian","product":"scholars_tracking_system","affected":["scholars_tracking_system = 1.0"],"published":"2026-02-18","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:17:28.360","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-70151","references":[{"url":"https://0x0bito.github.io/posts/CVE-2025-70151-Scholars-FileUpload-RCE/","label":"cve@mitre.org"},{"url":"https://code-projects.org/scholars-tracking-system-in-php-with-source-code/","label":"cve@mitre.org"},{"url":"https://youngkevinn.github.io/posts/CVE-2025-70151-Scholars-FileUpload-RCE/","label":"cve@mitre.org"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-02-18T18:21:30.851919Z"},"epss":0.00705,"epssPercentile":0.51258,"ingestedAt":"2026-09-08T20:10:03.219Z","slug":"CVE-2025-70151","body":"## Overview\n\ncode-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied filename without validating the file type or extension. By uploading a PHP file and then requesting it from /uploads/, an attacker can execute arbitrary PHP code as the web server user.\n\n## Affected\n\n- `scholars_tracking_system = 1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}