CVE-2026-11552
A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System 1.0. Affected by this issue is some unknown functionality of the file import_users.php. The manipulation of the argument raw_password with the input CICT_2026 leads to use of hard-coded password. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.29%
- CWE
- CWE-259, CWE-255
- Published
- 2026-06-08
- Last modified
- 2026-06-08
Affected products
- SourceCodester Onlne Examination & Learning Management System
- SourceCodester Syllabus-aligned Learning Management and Examination System
Weakness type
Related vulnerabilities
- CVE-2026-86673 — ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials
- CVE-2026-86276 — SourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentials
- CVE-2026-86150 — Tenda CP3 hostapd hard-coded credentials
- CVE-2026-70403 — XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the...
- CVE-2026-82808 — Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials
- CVE-2026-78062 — vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials
- CVE-2026-23933 — Hardcoded session key in Zabbix 7.4
- CVE-2026-19901 — LB-LINK X-PRO easycwmp hard-coded credentials