High severity8.8NVD Advisory· Published Feb 18, 2026· Updated Jun 17, 2026
CVE-2025-70151
CVE-2025-70151
Description
code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied filename without validating the file type or extension. By uploading a PHP file and then requesting it from /uploads/, an attacker can execute arbitrary PHP code as the web server user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:fabian:scholars_tracking_system:1.0:*:*:*:*:*:*:*
- Range: = 1.0
Patches
Vulnerability mechanics
References
2- youngkevinn.github.io/posts/CVE-2025-70151-Scholars-FileUpload-RCE/nvdExploitMitigationThird Party Advisory
- code-projects.org/scholars-tracking-system-in-php-with-source-code/nvdProduct
News mentions
0No linked articles in our index yet.