CVE-2026-6489

The record

A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This issue affects some unknown processing of the file admin/addteacher.php of the component Background Management Page. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Related vulnerabilities

• CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-284
• CVE-2026-83395 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-284
• CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-284
• CVE-2026-106580 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-284
• CVE-2026-61700 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-284
• CVE-2026-86812 The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of… CWE-284
• CVE-2026-85545 There is an Vulnerability in some HikCentral Access Control versions. CWE-284
• CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in… CWE-284