Is CVE-2026-86276 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86276 being exploited in the wild.

How severe is CVE-2026-86276?

High severity, with a CVSS score of 7.3, published 7 September 2026.

Is there a fix for CVE-2026-86276?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86276 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86276?

Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86276: SourceCodester Syllabus-Aligned Learning Management & Examination System hardcoded credentials and SQL injection

CVE-2026-86276 · Severity: high · CVSS 7.3 · Published 2026-09-07

A Learning Management System used by educational institutions to manage courses, exams, and student records contains multiple security flaws including hardcoded database credentials and SQL injection vulnerabilities. An attacker can exploit these issues remotely to access sensitive student and institutional data, take over user accounts, or manipulate exam records and grades without authentication.

Technologies: SourceCodester Syllabus-Aligned Learning Management & Examination System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-86276 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86276 being exploited in the wild.
How severe is CVE-2026-86276?: High severity, with a CVSS score of 7.3, published 7 September 2026.
Which products and versions are affected?: SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0.
Is there a fix for CVE-2026-86276?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86276 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86276?: Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability comprises multiple attack vectors: (1) hardcoded credentials in db.php that expose database access details; (2) second-order SQL injection in CSV import functionality (import_users.php); (3) SQL injection in multiple GET parameters including manage_subjects.php; and (4) default/hardcoded password patterns in the SQL dump allowing mass account takeover. The flaws are remotely exploitable without authentication. Attackers can extract sensitive data, inject malicious SQL, or hijack accounts using default credentials found in the application files or database schema. No patch information is available in the advisory.

Affected products

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0

Timeline

2026-09-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.