This vulnerability in College-Notes-Gallery up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6 allows an attacker to remotely upload files without restrictions by manipulating the 'image' parameter in the /dashboard/userprofile.php?section=admin1 functionality. The vulnerability requires low privileges and no user interaction. The exploit has been publicly released. Due to the rolling release nature of the product, no specific affected or patched versions are identified. The vendor has not provided any response or patch information.

An attacker with low privileges can remotely upload arbitrary files to the server, potentially leading to code execution or other malicious activities depending on the uploaded content and server configuration. The vulnerability has a medium severity score (CVSS 5.3). The public availability of exploit code increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch information is available, users should monitor for updates from the vendor. In the meantime, restricting access to the affected functionality and implementing file upload validation or filtering may reduce risk.