CVE-2026-91005: SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted upload
A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function moveuploadedfile of the file production/editpicture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack requires low-level privileges (PR:L), so the attacker must have an account or other access sufficient to reach the profile picture upload functionality. It can be exploited remotely and does not require user interaction.
Is exploit code available?
Yes. The exploit has been made public, which increases the likelihood that attackers could use it against exposed installations.
What is known about the affected scope?
The reported affected product is SourceCodester Online Faculty Clearance System 1.0, specifically the Profile Picture Upload component in production/edit_picture.php. The vulnerable operation is the move_uploaded_file call when handling the File argument.