Vulnerability Database

309,364

Total vulnerabilities in the database

CVE-2019-9181

SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the Content-Type to image/php, and placing PHP code after the JPEG data. This ultimately allows execution of arbitrary PHP code.

  • Published: Feb 26, 2019
  • Updated: Nov 9, 2025
  • CVE: CVE-2019-9181
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

Software From Fixed in
schoolcms / schoolcms 2.3.1 2.3.1.x