CVE-2026-14778
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability has been found in SourceCodester Online Examination & Learning Management System 1.0 in the /ajax_enroll.php file of the Enrollment Management component. Manipulation of the student_id, schedule_id, or action arguments leads to improper authorization, allowing unauthorized access.
Risk Assessment
A remote attacker could exploit this to manipulate course enrollments, compromising data integrity and system confidentiality.
Recommendation
Immediately update to the latest version or apply the vendor's patch. Until then, restrict access to /ajax_enroll.php and implement server-side authorization checks.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argument student_id/schedule_id/action leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The name of the affected product appears to have a typo in it.