CVE-2025-3565 - huanfenz/code-projects StudentManager Announcement Management Section uploadArticle.do unrestricted upload

Back Back to CVE browser

MEDIUM

huanfenz/code-projects StudentManager Announcement Management Section uploadArticle.do unrestricted upload

Published Apr 14, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.59%

Description

A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uploadArticle.do of the component Announcement Management Section. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Code-Projects Product StudentManager Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -
Vendor Huanfenz Product StudentManager Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Code-Projects

StudentManager

n/a

Version	Status	Constraints
1.0	affected	-

Huanfenz

StudentManager

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-434

Unrestricted Upload of File

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15041
Advisory
https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/StudentManager-xss.md
exploitThird Party Advisory
https://vuldb.com/?ctiid.304606
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.304606
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.549316
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15041		Advisory
https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/StudentManager-xss.md		exploitThird Party Advisory
https://vuldb.com/?ctiid.304606		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.304606		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.549316		third-party-advisoryThird Party AdvisoryVDB Entry