Is there a public PoC exploit available for CVE-2026-14719?

Yes, a public proof-of-concept exploit is available for CVE-2026-14719. Prioritise patching immediately. EPSS: 0.3%.

Onlne Examination LMS CVE-2026-14719

Q: What is the CVSS score of CVE-2026-14719?

CVE-2026-14719 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41733 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-05 VulDB

GHSA-cvww-px7g-8933

PHP Privilege Escalation Onlne Examination Learning Management System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Public registration endpoint requires no authentication (PR:N, AV:N); manipulation is trivial (AC:L); impact is limited to application-layer privilege escalation with no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 08:31 vuln.today

CVSS changed

Jul 05, 2026 - 08:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impacted element is an unknown function of the file register.php of the component Registration Endpoint. Executing a manipulation of the argument role can lead to improper privilege management. The attack can be executed remotely. The exploit has been published and may be used. The name of the affected product appears to have a typo in it.

AnalysisAI

Privilege escalation in SourceCodester's Onlne Examination & Learning Management System 1.0 (the product name itself contains a typo - 'Onlne' instead of 'Online') exposes an unauthenticated registration endpoint at register.php where the role parameter is not server-side validated, allowing any remote actor to self-assign elevated privileges at account creation. A publicly available exploit has been published on Pastebin, confirming the attack is trivially reproducible. No CISA KEV listing exists, but the CVSS 4.0 E:P modifier and Pastebin reference corroborate working exploit availability; no vendor patch has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based web platform distributed by SourceCodester for conducting online examinations and managing learning content. The vulnerability class is CWE-269 (Improper Privilege Management), meaning the application's registration logic in register.php accepts a user-supplied role parameter - such as 'admin' or 'instructor' - without server-side enforcement of what roles a self-registering user is permitted to claim. In PHP web applications, this pattern typically arises when POST/GET parameters are passed directly into database INSERT statements or session variables that govern access control, bypassing any intended role assignment workflow. The CPE string cpe:2.3:a:sourcecodester:onlne_examination_&_learning_management_system:*:*:*:*:*:*:*:* covers all sub-versions of the 1.0 release, and the wildcard version field suggests no patched release has been formally catalogued.

RemediationAI

No vendor-released patch has been identified at time of analysis; the CPE wildcard and absence of a vendor advisory confirm no fixed version is available. As an immediate compensating control, administrators should enforce server-side whitelisting of permitted role values in register.php - the role parameter must be validated against an allow-list of non-privileged values (e.g., 'student') and never accepted as a direct user-supplied string for privilege assignment. If administrative or instructor account creation is required, it should be gated behind a separate, authenticated workflow rather than exposed through the public registration endpoint. Optionally, disabling public self-registration entirely until a patch is available eliminates this attack surface with no functional impact for closed deployments. For internet-facing instances, a WAF rule blocking unexpected role parameter values can provide a layer of detection but should not be treated as a substitute for code-level fixes. The VulDB report and exploit reference are available at https://vuldb.com/vuln/376307 and the proof-of-concept at https://pastebin.com/Z4i5MGxk.