CVE Alert: CVE-2026-86277 – SourceCodester – Syllabus-Aligned Learning Management & Examination System

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file delete_exam.php. The manipulation of the argument ID leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Treat as a high operational priority: the network-reachable, unauthenticated attack path and public proof-of-concept indicator make opportunistic exploitation plausible, although KEV, SSVC and EPSS status are not provided.

An attacker may be able to alter or remove examination data without needing an account, creating immediate integrity and availability risks for teaching operations. Likely objectives include disrupting assessments, tampering with records, causing reputational harm, or using the application as an entry point for further compromise.

### Most likely attack path

An attacker sends a crafted request directly to the exposed application endpoint, manipulating the object identifier while requiring no login, user interaction or unusual conditions. Scope is unchanged, so direct impact is concentrated in the application and its database; broader lateral movement would require a separate weakness or stolen credentials.

### Who is most exposed

Institutions running this PHP application on public shared hosting, small virtual servers, or internet-facing student portals are most exposed, particularly where administrative functions are not segregated.

Review web-server logs for unauthenticated requests to the affected administrative endpoint and unusual identifier values.

Alert on successful destructive responses originating from external IP addresses.

Correlate application events with unexpected deletions or gaps in examination records.

Check database audit logs for rapid or out-of-hours record removal.

Hunt for follow-on access using the web server account.

### Mitigation and prioritisation

Apply a vendor-maintained fix or upgrade as soon as available; no remediation status is supplied.

Until then, restrict the endpoint by authentication, administrator IP allow-listing, or web-application firewall rules.

Validate authorisation server-side against each requested object, not only the interface.

Preserve backups and test restoration before making changes.

Confirm KEV, SSVC and EPSS data; their absence prevents definitive exploitation prioritisation.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.