The vulnerability identified as CVE-2026-19065 affects SourceCodester Online Examination & Learning Management System version 1.0. It arises from improper handling of file uploads in the upload_files.php script, which permits unrestricted file uploads. The flaw can be exploited remotely without user interaction or elevated privileges, potentially allowing an attacker to upload arbitrary files to the server.

Successful exploitation of this vulnerability could allow an attacker to upload malicious files to the affected system. This may lead to unauthorized file storage, execution of malicious code, or other impacts depending on the server configuration and the nature of the uploaded files. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, it is recommended to restrict file upload functionality, implement strict file type validation, and monitor for suspicious upload activity.