Remote Code Execution in Scholars Tracking System by Code-Projects
CVE-2025-70151

8.8HIGH

Key Information:

Vendor

Code-Projects

Status
Scholars Tracking System
Vendor
CVE Published:
18 February 2026

What is CVE-2025-70151?

The Scholars Tracking System version 1.0 by Code-Projects has a vulnerability that allows authenticated attackers to perform remote code execution (RCE). This is achieved through an unrestricted file upload mechanism present in the endpoints update_profile_picture.php and upload_picture.php. The application stores uploaded files directly in a publicly accessible directory without validating the file type or extension. This flaw permits attackers to upload malicious PHP files, which can be executed by simply accessing the file from the uploads directory, thereby compromising the server and gaining control over the web application's environment.

References

https://code-projects.org/scholars-tracking-system-in-php...
https://youngkevinn.github.io/posts/CVE-2025-70151-Schola...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.