CVE-2026-15539
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability in SourceCodester Online Book Store System 1.0 allows unrestricted file upload via the book image upload feature in /admin/index.php?page=books. This can lead to remote code execution. The exploit is publicly available.
Risk Assessment
An attacker can upload a malicious file (e.g., PHP script) to the server, potentially gaining control over the application and accessing sensitive data.
Recommendation
Immediately update the system to the latest version or apply a patch that restricts allowed file types and validates uploaded data.
Other vulnerabilities in SourceCodester Online Book Store System
See all- CVE-2026-15540Medium
A vulnerability was found in SourceCodester Online Book Store System 1.0, involving uncontrolled file inclusion (Local File Inclusion) in /admin/index.php. By manipulating the 'page' argument, an attacker can remotely include arbitrary PHP files, leading to unauthorized data access or code execution.
- CVE-2026-15537High
A SQL injection vulnerability has been discovered in SourceCodester Online Book Store System 1.0 in the file admin/login.php. An attacker can remotely manipulate the Username argument, leading to SQL injection. The exploit has been publicly released.
- CVE-2026-15532Low
A cross-site scripting vulnerability was found in SourceCodester Online Book Store System 1.0 in the User Management Module. Manipulation of the Name or Username arguments allows remote script execution. The exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.