CVE-2026-14775
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0 in the file /process_lesson.php. An unknown function allows unrestricted file upload via manipulation of the user_id argument. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
The risk involves an attacker being able to remotely upload a malicious file, potentially leading to server compromise or data theft.
Recommendation
Immediately update the system to the latest version or apply a security patch. If not possible, restrict access to /process_lesson.php and implement file upload validation.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesson.php. Such manipulation of the argument user_id leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the affected product appears to have a typo in it.