CVE-2026-86276: Hard-coded Credentials in SourceCodester Syllabus-Aligned Learning Management & Examination System

This vulnerability affects SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The issue arises from hard-coded credentials present in the db.php file, which can be manipulated remotely. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. An exploit has been published, indicating that the vulnerability can be leveraged by attackers, but no active exploitation in the wild has been confirmed. No patch or vendor advisory is available to confirm remediation status.

The presence of hard-coded credentials can allow remote attackers to gain unauthorized access to the system, potentially compromising confidentiality, integrity, and availability to a limited extent. The medium CVSS score reflects that the vulnerability is exploitable remotely without privileges or user interaction but with limited impact severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor for vendor updates and consider mitigating exposure by restricting access to the affected system and reviewing the use of hard-coded credentials in their deployment.