Medium severity · published Jul 5, 2026
CVE-2026-14776
SourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted upload
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathinfo of the file /upload_files.php of the component Filename Extension. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The name of the affected product appears to have a typo in it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OE
Onlne Examination & Learning Management System · SourceCodester
1.0 · source: vendor
Affected product
OE
Onlne Examination & Learning Management System
SourceCodester
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14776
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14776
github.com
https://github.com/nuiifornet/A033/blob/main/OE-LMS-RCE-2-upload_files.md
vuldb.com
https://vuldb.com/cve/CVE-2026-14776
vuldb.com
https://vuldb.com/submit/850678
vuldb.com
https://vuldb.com/vuln/376366
vuldb.com
https://vuldb.com/vuln/376366/cti
www.sourcecodester.com
https://www.sourcecodester.com/
More from Onlne Examination & Learning Management System
7.3
CVE-2026-14778
SourceCodester Onlne Examination & Learning Management System Enrollment Management ajax_enroll.php improper authorization
7.3
CVE-2026-14719
SourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges management
6.3
CVE-2026-14777
SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload
6.3
CVE-2026-14775
SourceCodester Onlne Examination & Learning Management System process_lesson.php unrestricted upload
5.3
CVE-2026-11552
SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password