{"id":"CVE-2022-39179","aliases":["EUVD-2022-41724","GHSA-g5fq-p794-xxc8"],"status":"published","title":"College Management System v1.0 - Authenticated remote code execution","description":"College Management System v1.0 - Authenticated remote code execution.\nAn admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload\n.php file that contains malicious code via student.php file.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01151,"percentile":0.67166,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2022-11-17T22:27:55Z","modified":"2026-06-17T04:57:51Z","products":[{"vendor":"college management","product":"college management system v1.0"},{"vendor":"college_management_system_project","product":"college_management_system"}],"references":[{"url":"https://www.gov.il/en/Departments/faq/cve_advisories","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39179"},{"url":"https://www.gov.il/en/departments/faq/cve_advisories"},{"url":"https://github.com/advisories/GHSA-g5fq-p794-xxc8"}],"sources":{"cve":[{"id":"CVE-2022-39179","title":"College Management System v1.0 - Authenticated remote code execution","description":"\nCollege Management System v1.0 - Authenticated remote code execution.\nAn admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload\n.php file that contains malicious code via student.php file.\n\n","status":"published","published":"2022-11-17T22:27:55.603Z","modified":"2025-04-28T18:14:25.817Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-41724","description":"\nCollege Management System v1.0 - Authenticated remote code execution.\nAn admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload\n.php file that contains malicious code via student.php file.\n\n","status":"published","published":"2022-11-17T22:27:55Z","modified":"2025-04-28T18:14:25Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:01.50163Z"}],"ghsa":[{"id":"GHSA-g5fq-p794-xxc8","title":"College Management System v1.0 - Authenticated remote code execution. An admin user (the...","description":"College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload .php file that contains malicious code via student.php file.","status":"published","published":"2022-11-18T00:30:19Z","modified":"2023-01-29T05:03:12Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:45:16.184529Z"}],"nvd":[{"id":"CVE-2022-39179","description":"\nCollege Management System v1.0 - Authenticated remote code execution.\nAn admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload\n.php file that contains malicious code via student.php file.\n\n","status":"published","published":"2022-11-17T23:15:18.49Z","modified":"2026-06-17T04:57:51.69Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:32.395456Z"}]}}