PHPEMS 11.0 contains a server-side request forgery vulnerability in the Instant Exam Creation Handler component, specifically in the temppage function of /app/exam/controller/exams.master.php. By manipulating the uploadfile parameter, an attacker can cause the server to send crafted requests to internal or external systems. This vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 score of 5.3 (medium severity). No official patch or vendor advisory is currently available, and the exploit has been publicly disclosed.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server to internal or external resources. This may lead to information disclosure or interaction with internal services not otherwise accessible. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. There is no current evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting or monitoring outbound requests from the affected server and validate or sanitize input parameters related to uploadfile. No official mitigation or temporary fix has been published by the vendor at this time.