PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11474 Kushan2k CVE debrief

A security flaw has been discovered in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. The vulnerability affects an unknown function of the file service/RegisterService.php of the component Registration Endpoint. Performing a manipulation of the argument stimg results in unrestricted upload. The attack may be initiated remotely.

Vendor
Kushan2k
Product
student-management-system
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a should be aware of this MEDIUM severity vulnerability.

Technical summary

The vulnerability has a CVSS score of 5.5 and is classified as CWE-284 and CWE-434. The exploit has been released to the public and may be used for attacks.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply updates as they become available, as the project uses a rolling release model to deliver continuous updates.
  • Monitor the project for an official response and patch.

Evidence notes

The project was informed of the problem early through an issue report but has not responded yet.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11474 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11474

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11474 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11474

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.