Is CVE-2026-11333 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11333 being exploited in the wild.

How severe is CVE-2026-11333?

Medium severity, with a CVSS score of 6.3, published 5 June 2026.

Which products and versions are affected?

Tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3.

Is there a fix for CVE-2026-11333?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11333 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11333?

Check whether you run Tittuvarghese CollegeManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11333: tittuvarghese CollegeManagementSystem unrestricted upload in upload_student_data.php

CVE-2026-11333 · Severity: medium · CVSS 6.3 · Published 2026-06-05

A security vulnerability exists in the CollegeManagementSystem, a platform used by engineering colleges to manage student records and academic data. An attacker can bypass file upload restrictions to place malicious scripts on the server. If exploited, this allows the attacker to take full control of the web server, potentially leading to the theft of student data, service disruption, or further attacks on the institution's network.

Technologies: Tittuvarghese CollegeManagementSystem. Vendors: Tittuvarghese.

Quick answers

Is CVE-2026-11333 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11333 being exploited in the wild.
How severe is CVE-2026-11333?: Medium severity, with a CVSS score of 6.3, published 5 June 2026.
Which products and versions are affected?: Tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3.
Is there a fix for CVE-2026-11333?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11333 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11333?: Check whether you run Tittuvarghese CollegeManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted file upload vulnerability exists in `dashboard_page/forms/upload_student_data.php` due to insufficient validation of the `Student-Data-CSV` parameter. The application relies solely on the client-provided `Content-Type` header (checking for `application/csv`) and uses `PATHINFO_EXTENSION` to determine the final filename without verifying against a whitelist. An authenticated attacker can upload a PHP shell by forging the MIME type and appending a `.php` extension. Because the upload directory is web-accessible and allows script execution, the attacker can execute arbitrary code by requesting the uploaded file.

Affected products

tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3

Timeline

2026-05-18: disclosed: Issue reported on GitHub repository
2026-06-05: advisory: CVE published by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.