Online Examination LMS CVE-2026-75151

Exploitation requires that a user currently authenticated to SourceCodester Online Examination & Learning Management System 1.0 be socially engineered into visiting a malicious URL or page controlled by the attacker (UI:P per the CVSS 4.0 vector). The application must be reachable from the network (AV:N); no special server-side configuration beyond a default installation is required. Exploitation is strictly bounded by the need for victim interaction - a passive, unauthenticated attacker cannot trigger the vulnerability without this step. The impact is further limited to low-severity integrity modification (VI:L), meaning the attacker can manipulate data but cannot extract credentials or cause service disruption based on available data. Non-default hardening such as SameSite cookie attributes or a reverse proxy enforcing CSRF headers would additionally block exploitation.

The CVSS 4.0 score of 5.3 (Medium) is consistent with the actual threat profile. The vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N reflects a scenario that is straightforward to execute but gated by mandatory victim interaction (UI:P), which meaningfully constrains opportunistic mass exploitation. Impact is limited solely to low integrity modification (VI:L) within the vulnerable system; there is no confidentiality or availability dimension confirmed. No EPSS data was provided, and the absence of a KEV listing and POC means exploitation is not confirmed as active or widespread. The product's narrow deployment footprint (a niche open-source academic tool) further reduces aggregate risk relative to its CVSS score. This is a genuine finding but not a high-priority enterprise emergency; it warrants remediation on a normal patch cycle rather than emergency response.

An attacker hosts a webpage containing a hidden HTML form whose action targets a sensitive LMS endpoint (e.g., grade modification or user role change). When an authenticated instructor or administrator visits the attacker's page - via phishing email or injected link - the victim's browser automatically submits the forged request with their active session cookie. The LMS processes the request as legitimate, completing the unauthorized modification without any visible indication to the victim.