Is CVE-2026-5472 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5472 being exploited in the wild.

How severe is CVE-2026-5472?

Medium severity, with a CVSS score of 6.3, published 3 April 2026.

Which products and versions are affected?

ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59.

Is there a fix for CVE-2026-5472?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5472 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5472?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5472: ProjectsAndPrograms School Management System unrestricted upload in Profile Picture Handler

CVE-2026-5472 · Severity: medium · CVSS 6.3 · Published 2026-04-03

A security vulnerability exists in the ProjectsAndPrograms School Management System, a platform used for managing educational institutions. An authenticated user, such as a teacher or administrator, can upload malicious files through the profile picture update feature. This could allow an attacker to take full control of the server, potentially leading to the theft of student data or a complete shutdown of school operations.

Quick answers

Is CVE-2026-5472 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5472 being exploited in the wild.
How severe is CVE-2026-5472?: Medium severity, with a CVSS score of 6.3, published 3 April 2026.
Which products and versions are affected?: ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59.
Is there a fix for CVE-2026-5472?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5472 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5472?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted file upload vulnerability exists in the Profile Picture Handler component of the ProjectsAndPrograms School Management System. The flaw is located in the handling of the 'File' argument within /admin_panel/settings.php (specifically involving assets/updateProfilePic.php). Authenticated users with Admin or Teacher privileges can bypass file type restrictions to upload arbitrary PHP scripts. By accessing the uploaded file via its direct path on the server, an attacker can achieve Remote Code Execution (RCE). A proof-of-concept exploit has been publicly disclosed.

Affected products

ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59

Timeline

2026-04-03: disclosed
2026-04-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.