A vulnerability in College‑Notes‑Gallery allows a remote attacker to manipulate the image parameter in the "/dashboard/userprofile.php?section=admin1" endpoint and upload an arbitrary file. The likely impact, inferred from the description, is that the attacker could place a malicious script on the server, leading to execution with the privileges of the web application, which fits the CWE‑284 (Improper Access Control) and CWE‑434 (Unrestricted Upload of File with Dangerous Type) weaknesses. This represents a moderate severity risk due to the potential for code execution on the host.

The affected vendor is anirbandutta9 and the product is College‑Notes‑Gallery. All releases up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6 are vulnerable. No patched version or newer release is currently available, and the project uses a rolling release model.

The vulnerability can be exploited over the network by sending a crafted HTTP request containing a malicious file to the vulnerable endpoint. The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog. Because the application lacks proper authentication checks and file type validation, an attacker can upload files remotely and potentially execute them, especially if the upload endpoint is accessible to unauthenticated users.