A vulnerability in PHPGurukul News Portal 1.0 allows users to upload arbitrary files through the Profile Pic Handler. The upload process does not enforce file type validation or access controls. Based on the description, it is inferred that uploading a malicious file such as a web shell or executable could lead to remote code execution if the server executes such files. The flaw is an unrestricted upload that ignores file type validation.

The affected product is PHPGurukul News Portal version 1.0. No additional affected components or versions were disclosed beyond the Entry version listed in the CPE strings.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the description confirms that the exploit is publicly available and can be initiated remotely. Attackers can exploit the flaw by crafting a multipart request that uploads a file with an allowed extension or MIME type but containing payload code. Based on the description, it is inferred that if the web server permits execution of files in the upload directory, remote code execution could be possible. The risk is limited to systems running the unpatched PHPGurukul News Portal 1.0 where the upload directory is accessible to attackers.