EUVD-2026-23703
GHSA-4q2m-7ch2-98qj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.master.php of the component Instant Exam Creation Handler. The manipulation of the argument uploadfile results in server-side request forgery. The attack can be executed remotely. The exploit is now public and may be used.
AnalysisAI
Server-side request forgery in PHPEMS 11.0 allows authenticated remote attackers to manipulate the uploadfile parameter in the Instant Exam Creation Handler component, enabling SSRF attacks that can access internal resources or perform unauthorized requests from the server. The vulnerability affects the temppage function in /app/exam/controller/exams.master.php and has public exploit code available, though exploitation requires valid user credentials (PR:L).
Technical ContextAI
PHPEMS is a PHP-based examination management system. The vulnerability stems from improper input validation in the temppage function of the Instant Exam Creation Handler component, specifically in how the uploadfile parameter is processed. CWE-918 identifies the root cause as improper control of a dynamically-constructed URL or string, meaning the application constructs URLs or HTTP requests based on user-supplied input without adequate sanitization. The attackers can craft malicious uploadfile values to cause the server to make requests to unintended destinations such as internal services, metadata endpoints, or other networked resources, potentially bypassing access controls that rely on network isolation.
RemediationAI
Upgrade PHPEMS to a patched version if available from the project maintainers - verify patch availability directly with the PHPEMS project as no specific fixed version is confirmed in current data. If a patched version is not immediately available, implement the following compensating controls: restrict access to the Instant Exam Creation Handler component via web application firewall rules, specifically blocking POST requests to /app/exam/controller/exams.master.php with suspiciously-formed uploadfile parameters (implement allowlist of valid URLs if possible); enforce network-level egress filtering to restrict the PHPEMS server's outbound connections to only approved destinations (block access to internal IP ranges 10.0.0.0/8, 172.16.0.0/12, 169.254.0.0/16 and cloud metadata endpoints like 169.254.169.254); require multi-factor authentication for PHPEMS accounts to reduce the likelihood of compromised credentials being exploited for SSRF. Monitor application logs for uploadfile parameter manipulation attempts and unexpected outbound connections from the PHPEMS process.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today