EUVD-2026-54215
GHSA-5x2h-m6rc-h6x4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unrestricted PHP file upload enables webshell deployment and full server RCE, warranting C:H/I:H/A:H with scope change; PR:L reflects the CVSS 4.0 source, though the Authentication Bypass tag introduces uncertainty.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file upload_files.php. This manipulation causes unrestricted upload. The attack may be initiated remotely.
AnalysisAI
Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Technical ContextAI
The affected product is a PHP-based web Learning Management System distributed by SourceCodester (sourcecodester.com). The vulnerable component is upload_files.php, a server-side PHP script that handles file upload operations. CWE-284 (Improper Access Control) indicates that the root cause is not solely missing file-type validation, but a failure to enforce proper access controls governing what may be uploaded, by whom, and where files are stored. In PHP-based LMS platforms, uploaded files stored within the web root in executable directories can trivially be leveraged for webshell deployment and remote code execution. The 'Authentication Bypass' tag from VulDB suggests the endpoint may improperly enforce session or permission checks, potentially allowing unauthenticated upload despite the PR:L CVSS rating. No CPE string was provided, but the affected product is confirmed as version 1.0 per EUVD-2026-54215.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis - all references point to VulDB and the SourceCodester product page without a specific advisory or patched release. Until a patch is issued, administrators should immediately restrict or disable access to upload_files.php via web server configuration (e.g., deny rules in .htaccess or nginx location blocks), which eliminates the attack surface at the cost of disabling file upload functionality. If file uploads are required, enforce strict server-side file type validation by allowlisting only safe MIME types and extensions, and store uploaded files outside the web root in a non-executable directory to prevent webshell execution. Additionally, enforce strong session authentication controls on all upload endpoints and audit existing uploaded content for suspicious PHP or script files. Monitor VulDB (https://vuldb.com/vuln/386534) for patch availability updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-284 – Improper Access Control
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today