SourceCodester LMS CVE-2026-11552

Q: What is the CVSS score of CVE-2026-11552?

CVE-2026-11552 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35174 MEDIUM

Use of Hard-coded Password (CWE-259)

2026-06-08 VulDB

GHSA-fx8r-jc2f-g565

PHP Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 18:33 vuln.today

CVSS changed

Jun 08, 2026 - 18:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System 1.0. Affected by this issue is some unknown functionality of the file import_users.php. The manipulation of the argument raw_password with the input CICT_2026 leads to use of hard-coded password. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.

AnalysisAI

Hard-coded credential exposure in SourceCodester's Online Examination & Learning Management System 1.0 (also distributed as Syllabus-aligned Learning Management and Examination System 1.0) allows remote unauthenticated attackers to exploit a statically embedded password ('CICT_2026') in the import_users.php file without any authentication or user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated remote exploitation at low complexity, and the E:P exploit maturity modifier alongside the CVE description's explicit statement of public disclosure confirm that publicly available exploit code exists. Impact is constrained to low confidentiality exposure against the vulnerable component with no confirmed integrity or availability consequences.

Technical ContextAI

The affected system is a PHP-based learning management and examination platform developed by SourceCodester and distributed under two distinct product names: 'Online Examination & Learning Management System' (CPE: cpe:2.3:a:sourcecodester:onlne_examination_&_learning_management_system:*:*:*:*:*:*:*:*) and 'Syllabus-aligned Learning Management and Examination System' (CPE: cpe:2.3:a:sourcecodester:syllabus-aligned_learning_management_and_examination_system:*:*:*:*:*:*:*:*), both at version 1.0. The root cause is CWE-259 (Use of Hard-coded Password): the file import_users.php processes a raw_password argument whose expected value is statically hard-coded in the application source as 'CICT_2026'. Hard-coded credentials represent a design-level flaw where authentication secrets are baked directly into source code rather than managed through secure credential stores or runtime configuration, making them trivially discoverable through source code review, public repository browsing, or - as in this case - direct CVE disclosure. The PHP tag in the intelligence metadata confirms the server-side language; the Authentication Bypass tag reflects that knowledge of the static value is sufficient to circumvent the credential check entirely.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix requires modifying import_users.php to remove the static 'CICT_2026' value from the raw_password argument and replacing it with a securely managed credential - for example, a bcrypt-hashed password configured during installation or set by an administrator through a secure setup workflow. As an immediate compensating control, restrict web server access to import_users.php using Apache .htaccess directives (e.g., 'Require ip <trusted-range>') or nginx location blocks (e.g., 'deny all') so the file is unreachable from untrusted networks; note this mitigation is bypass-able if access controls are misconfigured and does not fix the underlying flaw. If the user import feature is not actively used, removing or renaming import_users.php entirely eliminates the attack surface with no functional trade-off for most deployments. Placing the application behind a VPN or firewall to prevent direct internet exposure is the most broadly effective network-level control. Monitor VulDB entry https://vuldb.com/vuln/369162 and https://www.sourcecodester.com/ for any patch release.