Is CVE-2026-11552 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11552 being exploited in the wild.

How severe is CVE-2026-11552?

Medium severity, with a CVSS score of 5.3, published 8 June 2026.

Is there a fix for CVE-2026-11552?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11552 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11552?

Check whether you run SourceCodester Online Examination & Learning Management System or SourceCodester Syllabus-aligned Learning Management and Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11552: SourceCodester Online Examination & Learning Management System hard-coded password in import_users.php

CVE-2026-11552 · Severity: medium · CVSS 5.3 · Published 2026-06-08

A security vulnerability exists in the SourceCodester Online Examination & Learning Management System. The software contains a hard-coded password within its user import functionality, which could allow an unauthorized person to gain access to the system. This could lead to the exposure of student or examination data and compromise the integrity of the learning platform.

Technologies: SourceCodester Online Examination & Learning Management System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-11552 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11552 being exploited in the wild.
How severe is CVE-2026-11552?: Medium severity, with a CVSS score of 5.3, published 8 June 2026.
Which products and versions are affected?: SourceCodester Syllabus-aligned Learning Management and Examination System 1.0.
Is there a fix for CVE-2026-11552?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11552 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11552?: Check whether you run SourceCodester Online Examination & Learning Management System or SourceCodester Syllabus-aligned Learning Management and Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as CWE-259 (Use of Hard-coded Password) exists in SourceCodester Online Examination & Learning Management System 1.0 (also distributed as Syllabus-aligned Learning Management and Examination System). The issue is located in the 'import_users.php' file, where the 'raw_password' argument is manipulated using a hard-coded value ('CICT_2026'). A remote attacker can exploit this to bypass intended credential management or predict user passwords during the import process. The exploit has been disclosed publicly, increasing the risk of unauthorized access. No official patch has been confirmed at this time.

Affected products

SourceCodester Onlne Examination & Learning Management System 1.0
SourceCodester Syllabus-aligned Learning Management and Examination System 1.0

Timeline

2026-06-08: disclosed: Exploit disclosed to the public
2026-06-08: advisory: CVE published by NVD/VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.