CVE-2026-14776
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A security flaw in SourceCodester Online Examination & Learning Management System 1.0 allows unrestricted file upload via the /upload_files.php file due to improper filename extension validation. Remote exploitation is possible and the exploit has been publicly released.
Risk Assessment
The organization is at risk of remote code execution or server compromise through malicious file upload. Unrestricted upload can lead to full system takeover.
Recommendation
Immediately update the system to the latest version or apply a security patch. If not possible, disable or secure the /upload_files.php file and implement server-side file type validation.
Other vulnerabilities in SourceCodester Online Examination & Learning Management System
See all- CVE-2026-75151Medium
A vulnerability has been found in SourceCodester Online Examination & Learning Management System 1.0, affecting an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely.
- CVE-2026-19066Medium
Authorization bypass vulnerability in SourceCodester Online Examination & Learning Management System 1.0, in an unknown function of the file view_students.php, via manipulation of the argument class_group. The attack can be launched remotely.
- CVE-2026-19065Medium
Unrestricted file upload vulnerability in SourceCodester Online Examination & Learning Management System 1.0, in some unknown processing of the file upload_files.php. The attack may be initiated remotely.
- CVE-2026-19064Medium
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0 in the file /view.php. Manipulation of the ID argument results in authorization bypass. The attack can be launched remotely.
- CVE-2026-14778High
A vulnerability has been found in SourceCodester Online Examination & Learning Management System 1.0 in the /ajax_enroll.php file of the Enrollment Management component. Manipulation of the student_id, schedule_id, or action arguments leads to improper authorization, allowing unauthorized access.
- CVE-2026-14777Medium
A weakness in SourceCodester Online Examination & Learning Management System 1.0 in the file /announcements.php allows unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-14775Medium
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0 in the file /process_lesson.php. An unknown function allows unrestricted file upload via manipulation of the user_id argument. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-14719High
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0 in the register.php file. Manipulation of the role argument during registration can lead to improper privilege management. The attack can be performed remotely and the exploit has been published.
- CVE-2026-11552Medium
A hard-coded password vulnerability was found in SourceCodester Online Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System 1.0 in the import_users.php file. Manipulation of the raw_password argument with input CICT_2026 enables remote attack. Exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathinfo of the file /upload_files.php of the component Filename Extension. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The name of the affected product appears to have a typo in it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS