SourceCodester LMS CVE-2026-86276

The hard-coded credentials reside in db.php, a PHP file included by the application's backend. Exploitation requires either: (1) the web server is misconfigured to serve the raw PHP source of db.php rather than executing it (uncommon but possible on misconfigured servers), or (2) a secondary vulnerability - such as the SQL injection documented in the same GitHub report - allows reading arbitrary files from the filesystem, or (3) the attacker has access to the application's source code through another channel (e.g., version control exposure, backup file exposure). Once credentials are obtained, the database must be reachable from the attacker's network position (direct TCP access or through the application). Exploitation is further limited to installations running version 1.0 of this specific SourceCodester product; non-default database network exposure would be required for direct database attacks from external networks.

The CVSS 4.0 base score of 6.9 captures a moderate but tangible risk: low-complexity network exploitation with no authentication requirement, yielding limited confidentiality, integrity, and availability impact across the vulnerable system. EPSS data was not provided, but the existence of a public exploit - documented in a GitHub vulnerability report alongside an SQL injection finding for the same product - meaningfully raises the likelihood of opportunistic exploitation. Even a mid-sized municipal IT team in sopot running this LMS on a shared educational server should treat this as urgent, since database credential exposure can cascade into broader compromise if the database is accessible from the network or the same credentials are reused elsewhere. The 'Authentication Bypass' framing in the tags overstates the immediate mechanism; the true entry point is credential disclosure (CWE-798), with authentication bypass being a downstream consequence. No CISA KEV listing was identified, and no vendor patch has been announced, leaving organizations with only compensating controls. The practical impact is bounded by the product's limited deployment footprint - SourceCodester releases are predominantly used in academic or student-project contexts rather than enterprise environments.

An attacker identifies a SourceCodester LMS instance via web search or fingerprinting, then retrieves db.php directly via HTTP or through a secondary file-read vulnerability to extract the plaintext database credentials. With those credentials, the attacker connects to the database server directly (if exposed to the network) or uses the credentials to escalate within the application, modifying exam records or extracting student PII. A public PoC report on GitHub documents the credential location and exploitation path.