Is there a public PoC exploit available for CVE-2026-5546?

Yes, a public proof-of-concept exploit is available for CVE-2026-5546. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5546

Q: What is the CVSS score of CVE-2026-5546?

CVE-2026-5546 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19040 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-05 VulDB

GHSA-hmqj-h9pm-wq53

PHP File Upload

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 06:45 euvd

EUVD-2026-19040

Analysis Generated

Apr 05, 2026 - 06:45 vuln.today

CVE Published

Apr 05, 2026 - 06:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in Campcodes Complete Online Learning Management System 1.0. This impacts the function add_lesson of the file /application/models/Crud_model.php. This manipulation causes unrestricted upload. It is possible to initiate the attack remotely. The exploit has been published and may be used.

AnalysisAI

Unrestricted file upload in Campcodes Complete Online Learning Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the add_lesson function in /application/models/Crud_model.php, enabling potential remote code execution or malware deployment. The vulnerability requires low-privilege authentication, carries a CVSS score of 6.3 (medium), and publicly available exploit code exists.

Technical ContextAI

The vulnerability resides in the add_lesson function within Crud_model.php, a PHP-based model file handling lesson creation in the Campcodes learning management system. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating insufficient validation or filtering of uploaded file types, names, or contents. Attackers with authenticated access can bypass file upload restrictions by crafting malicious requests that deliver executable files (such as PHP shells) to the server. The attack vector is network-based with low complexity, requiring only valid authentication credentials.

RemediationAI

Organizations should immediately update Campcodes Complete Online Learning Management System to a patched version released after version 1.0. Specific patched version numbers are not provided in available data; consult https://www.campcodes.com/ for the latest security release. As an interim workaround, restrict access to the /application/models/Crud_model.php endpoint and the add_lesson function via web server access controls, limit LMS user registration to trusted accounts only, and monitor /var/www/html (or equivalent upload directory) for unexpected executable files. Implement strict file type validation on the server side, verify that .php and other executable extensions cannot be uploaded or executed in user-accessible directories, and enforce Content-Disposition: attachment headers on file downloads. Leverage the published exploit code (available at https://github.com/whatyourname12345/CVE/tree/main/OLMS) to validate that mitigations are in place before patching is possible.