Is CVE-2026-86280 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86280 being exploited in the wild.

How severe is CVE-2026-86280?

Medium severity, with a CVSS score of 5.3, published 7 September 2026.

Is there a fix for CVE-2026-86280?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86280 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86280?

Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86280: SourceCodester Syllabus-Aligned LMS cleartext storage of sensitive information

CVE-2026-86280 · Severity: medium · CVSS 5.3 · Published 2026-09-07

SourceCodester's Syllabus-Aligned Learning Management & Examination System (CICT Portal) stores sensitive information including database credentials, user passwords, and student data in cleartext within SQL dump files and application code. An attacker with remote network access can extract these credentials and personally identifiable information, potentially gaining unauthorized access to student records, examination data, and the underlying database.

Technologies: SourceCodester Syllabus-Aligned Learning Management & Examination System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-86280 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86280 being exploited in the wild.
How severe is CVE-2026-86280?: Medium severity, with a CVSS score of 5.3, published 7 September 2026.
Which products and versions are affected?: SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0.
Is there a fix for CVE-2026-86280?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86280 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86280?: Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cleartext storage of sensitive information flaw affecting multiple components: hardcoded database credentials in db.php, plaintext password disclosure in the cict_portal.sql database dump file (line 441), and hardcoded test user credentials in add_user.php. The root cause is the lack of credential encryption and the inclusion of sensitive data in deployment packages. An unauthenticated attacker can download or access the SQL dump file and application source files via the web application, retrieve database credentials directly, and gain direct access to the MySQL database or escalate privileges to the admin account. No authentication or special preconditions are required beyond network access to the application. Patches or configuration changes to remove hardcoded secrets and encrypt credentials are not yet confirmed as released.

Affected products

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0

Timeline

2026-09-07: disclosed
other: CVE-2026-86280 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.