CVE-2026-14776
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A security flaw in SourceCodester Online Examination & Learning Management System 1.0 allows unrestricted file upload via the /upload_files.php file due to improper filename extension validation. Remote exploitation is possible and the exploit has been publicly released.
Risk Assessment
The organization is at risk of remote code execution or server compromise through malicious file upload. Unrestricted upload can lead to full system takeover.
Recommendation
Immediately update the system to the latest version or apply a security patch. If not possible, disable or secure the /upload_files.php file and implement server-side file type validation.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathinfo of the file /upload_files.php of the component Filename Extension. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The name of the affected product appears to have a typo in it.