CVE-2026-90857: SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload

Published Sep 15, 2026

Updated

A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit is now public and may be used.

Affected Software

1 affected component

Sourcecodester College Notes Gallery Management System=1.0

Event History

Sep 15, 2026

CVE Published

via MITRE·03:15 AM

Data Sourced

via MITRE·03:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack can be initiated remotely, but the CVSS vector indicates that low-level privileges are required. No user interaction is required.

Is there public exploit code available?

Yes. The vulnerability data states that an exploit is public and may be used.

Which component should be prioritized for investigation?

Prioritize the Profile Upload functionality in /dashboard/userprofile.php, specifically handling of the image argument. The affected product version identified in the data is 1.0.