Medium severity · published Jun 8, 2026
CVE-2026-11552
SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System 1.0. Affected by this issue is some unknown functionality of the file import_users.php. The manipulation of the argument raw_password with the input CICT_2026 leads to use of hard-coded password. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected product
OE
Onlne Examination & Learning Management System
SourceCodester
More from Onlne Examination & Learning Management System
7.3
CVE-2026-14778
SourceCodester Onlne Examination & Learning Management System Enrollment Management ajax_enroll.php improper authorization
7.3
CVE-2026-14719
SourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges management
6.3
CVE-2026-14777
SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload
6.3
CVE-2026-14776
SourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted upload
6.3
CVE-2026-14775
SourceCodester Onlne Examination & Learning Management System process_lesson.php unrestricted upload