Is there a public PoC exploit available for CVE-2026-14777?

Yes, a public proof-of-concept exploit is available for CVE-2026-14777. Prioritise patching immediately. EPSS: 0.2%.

SourceCodester LMS CVE-2026-14777

Q: What is the CVSS score of CVE-2026-14777?

CVE-2026-14777 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41792 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-05 VulDB

GHSA-cmj5-gqvg-2g8x

PHP File Upload Onlne Examination Learning Management System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-accessible, low-privilege upload enabling PHP webshell execution yields scope change and full server compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

Jul 06, 2026 - 00:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 05, 2026 - 23:51 vuln.today

DescriptionCVE.org

A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this issue is some unknown functionality of the file /announcements.php. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The name of the affected product appears to have a typo in it.

AnalysisAI

Unrestricted file upload in SourceCodester's "Onlne Examination & Learning Management System" 1.0 (note: product name contains a known typo per CVE data) exposes the /announcements.php endpoint to arbitrary file upload by low-privileged authenticated users. A publicly available proof-of-concept, referenced under the title 'OE-LMS-RCE-3-announcements.md', demonstrates that the flaw can be leveraged for remote code execution - a significantly more severe real-world impact than the low CIA metrics in the provided CVSS 4.0 score suggest. No active exploitation (CISA KEV) has been confirmed, but the combination of low-complexity exploitation, a network-accessible vector, and a public POC elevates practical risk well above the 5.3 base score.

Technical ContextAI

The affected application is a PHP-based learning management system distributed by SourceCodester (cpe:2.3:a:sourcecodester:onlne_examination_&_learning_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the /announcements.php endpoint accepts file uploads without adequately validating or restricting the file type or extension. In PHP web applications, this class of vulnerability is critically dangerous because uploaded files stored in web-accessible directories can be requested directly by the attacker, causing the PHP runtime to execute attacker-supplied server-side code - commonly referred to as a webshell. The absence of server-side MIME type enforcement or extension allowlisting is the specific technical failure here.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary mitigation is to restrict file uploads in /announcements.php by implementing a strict server-side allowlist of permitted non-executable file extensions (e.g., .pdf, .png, .jpg) and rejecting all others - client-side filtering alone is insufficient. Uploaded files must be stored outside the web root or in a directory configured to deny script execution (e.g., via .htaccess 'Options -ExecCGI' and 'php_flag engine off'), which prevents webshell execution even if a malicious file is uploaded. As an interim compensating control, restrict access to /announcements.php to trusted IP ranges or require elevated authentication. Reference the VulDB entry at https://vuldb.com/vuln/376367 and monitor https://www.sourcecodester.com/ for any patch release. Given this is a free community PHP script, a vendor patch may not be forthcoming and self-patching the upload validation logic is the most reliable fix.