An unrestricted file upload flaw exists in the Profile Picture Handler of the Admin Panel. The function that handles the uploaded file argument is improperly validated, allowing an attacker to supply a malicious file. Because the upload is performed over the web and the file is stored on the server, an attacker can place executable code and subsequently trigger its execution, resulting in full remote code execution. The vulnerability is confirmed by published exploits that demonstrate this capability.

ProjectsAndPrograms School Management System, versions up to and including the code commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The product uses a rolling release model, so any released version before the commit that addresses the flaw remains vulnerable.

The CVSS score of 5.3 indicates medium severity, but the presence of a publicly documented remote exploit and the high impact of code execution elevate practical risk. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, yet an attacker can reach the target via the web interface, making exploitation feasible in real‑world scenarios.