This vulnerability involves an unrestricted file upload flaw in the Kushan2k student-management-system, specifically in the Registration Endpoint component within service/RegisterService.php. Manipulating the 'stimg' argument enables remote attackers to upload files without restriction. The system's rolling release model prevents precise version identification for affected or patched releases. Although the issue was reported early, no vendor response or remediation is currently available. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to upload arbitrary files to the system, potentially leading to unauthorized code execution or system compromise depending on how uploaded files are handled. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as per the CVSS vector. No confirmed exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a fix is available, restricting access to the vulnerable endpoint and implementing application-level controls to validate and restrict file uploads may help mitigate risk.