# CVE-2026-14777: SourceCodester Online Examination & Learning Management System unrestricted upload in announcements.php

Source: https://junglewise.ai/threats/cve-2026-14777-sourcecodester-online-examination-learning-management-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-14777 · Severity: medium · CVSS 6.3 · Published 2026-07-06

A security vulnerability exists in the SourceCodester Online Examination & Learning Management System, a platform used for managing educational content and exams. An attacker can exploit this flaw to upload unauthorized files to the server. This could allow a malicious actor to gain control over the system, potentially leading to data theft or a complete service disruption.

Technologies: [SourceCodester Online Examination & Learning Management System](https://junglewise.ai/threats/technologies/online-examination-learning-management-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-14777 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14777 being exploited in the wild.

**How severe is CVE-2026-14777?** Medium severity, with a CVSS score of 6.3, published 6 July 2026.

**Which products and versions are affected?** SourceCodester Online Examination & Learning Management System 1.0.

**Is there a fix for CVE-2026-14777?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14777 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14777?** Check whether you run SourceCodester Online Examination & Learning Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability (CWE-434) exists in SourceCodester Online Examination & Learning Management System 1.0 within the 'announcements.php' file. The application fails to properly validate file types or permissions during the upload process. A remote attacker with low-level privileges can exploit this by uploading a malicious script (such as a PHP shell) to the server. Successful exploitation allows for remote code execution (RCE) on the underlying host. A public exploit has been disclosed, increasing the risk of active exploitation.

## Affected products

- SourceCodester Online Examination & Learning Management System 1.0

## Timeline

- 2026-07-06: advisory: Vulnerability published in NVD and VulDB

## References

- [https://github.com/nuiifornet/A033/blob/main/OE-LMS-RCE-3-announcements.md](https://github.com/nuiifornet/A033/blob/main/OE-LMS-RCE-3-announcements.md)
- [https://vuldb.com/cve/CVE-2026-14777](https://vuldb.com/cve/CVE-2026-14777)
- [https://vuldb.com/submit/850679](https://vuldb.com/submit/850679)
- [https://vuldb.com/vuln/376367](https://vuldb.com/vuln/376367)
- [https://vuldb.com/vuln/376367/cti](https://vuldb.com/vuln/376367/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Online Examination & Learning Management System improper authorization in ajax_enroll.php](https://junglewise.ai/threats/cve-2026-14778-sourcecodester-online-examination-learning-management-system)
- [SourceCodester Online Examination & Learning Management System unrestricted upload in upload_files.php](https://junglewise.ai/threats/cve-2026-14776-sourcecodester-online-examination-learning-management-system)
- [SourceCodester Online Examination & Learning Management System unrestricted upload in process_lesson.php](https://junglewise.ai/threats/cve-2026-14775-sourcecodester-online-examination-learning-management-system)
- [SourceCodester Online Examination & LMS privilege escalation in registration endpoint](https://junglewise.ai/threats/cve-2026-14719-sourcecodester-online-examination-lms-privilege-escalation-in)
- [SourceCodester Online Examination & Learning Management System hard-coded password in import_users.php](https://junglewise.ai/threats/cve-2026-11552-sourcecodester-online-examination-learning-management-system-hard)