An attacker can manipulate the Student-Data-CSV parameter in upload_student_data.php to upload files without restriction. This vulnerability exposes the system to arbitrary file uploads, potentially including executable code, which can compromise the web server and application. The weakness is categorized as improper access control (CWE‑284) and unrestricted upload of file with dangerous type (CWE‑434).

The vulnerability affects the CollegeManagementSystem developed by tittuvarghese. Version details are not available because the project follows a rolling‑release model and has not published a fixed release. Any current deployment of the system is potentially impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be launched remotely; the exact authentication requirements are not specified, but the lack of access controls suggests that unauthenticated or low‑privileged users might be able to exploit it. Without proactive mitigation, an attacker could upload a malicious file that the web server might execute, leading to remote code execution.