SourceCodester LMS EUVD-2026-54207

Q: What is the CVSS score of EUVD-2026-54207?

EUVD-2026-54207 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-19064 MEDIUM

Improper Authorization (CWE-285)

2026-08-06 cna@vuldb.com

GHSA-qx62-vjqq-ph5w

PHP Authentication Bypass

5.3

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible IDOR requiring authenticated session (PR:L); scope unchanged, only limited confidentiality disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:16 vuln.today

DescriptionCVE.org

A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely.

AnalysisAI

Authorization bypass in SourceCodester Online Examination & Learning Management System 1.0 allows authenticated low-privilege users to access records belonging to other users by manipulating the id parameter in the /view.php endpoint without proper ownership verification. The CVSS 4.0 vector (PR:L, AV:N, VC:L) confirms the flaw is remotely reachable but requires prior authentication, and impact is limited to confidentiality disclosure of a single record type. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.

Technical ContextAI

The application is a PHP-based Learning Management System freely distributed by SourceCodester (sourcecodester.com), targeting small educational institutions and students. The vulnerability resides in /view.php, where the PHP backend fails to validate that the authenticated session's owner matches the resource identified by the user-supplied id parameter - a classic Insecure Direct Object Reference (IDOR) pattern. CWE-285 (Improper Authorization) is the root cause class: the application relies on authentication state alone, without enforcing resource-level access control. No CPE string was provided in the available intelligence; the sole confirmed affected release is version 1.0 per ENISA EUVD-2026-54207.

RemediationAI

No vendor-released patch or updated version has been identified from the available intelligence at time of analysis. SourceCodester does not maintain a formal security advisory or patch release process; users should monitor sourcecodester.com and the VulDB entry at https://vuldb.com/vuln/386533 for any updated releases. As an immediate compensating control, add server-side ownership validation in /view.php to confirm that the authenticated session's user ID matches the owner of the resource identified by the id parameter before returning any data - this is a targeted code change with no functional side effects for legitimate users. If application modification is not feasible, restrict access to the affected endpoint to specific trusted IP ranges via web server or firewall rules, accepting the trade-off of reduced user accessibility. Organizations running this application in environments with sensitive data should consider taking it offline until a fixed version is available.