Is CVE-2026-86281 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86281 being exploited in the wild.

How severe is CVE-2026-86281?

Medium severity, with a CVSS score of 4.3, published 7 September 2026.

Is there a fix for CVE-2026-86281?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86281 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86281?

Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86281: SourceCodester Syllabus-Aligned Learning Management & Examination System CSRF in state-changing operations

CVE-2026-86281 · Severity: medium · CVSS 4.3 · Published 2026-09-07

The SourceCodester Syllabus-Aligned Learning Management & Examination System is a web-based platform for educational institutions to manage courses, exams, and student enrollment. A cross-site request forgery vulnerability allows attackers to trick authenticated users into performing unauthorized actions such as deleting exams, modifying enrollments, or purging attendance records by embedding malicious links or forms on external websites.

Technologies: SourceCodester Syllabus-Aligned Learning Management & Examination System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-86281 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86281 being exploited in the wild.
How severe is CVE-2026-86281?: Medium severity, with a CVSS score of 4.3, published 7 September 2026.
Which products and versions are affected?: SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0.
Is there a fix for CVE-2026-86281?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86281 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86281?: Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a cross-site request forgery (CSRF) vulnerability caused by missing anti-CSRF tokens and insufficient request validation in critical state-changing operations. The application lacks proper token-based protection on endpoints that modify exam records, student enrollments, and attendance data. Additionally, some operations use GET requests for state changes and do not validate the Referer or Origin headers. An unauthenticated attacker can craft a malicious webpage containing image tags or auto-submitting forms that, when visited by an authenticated user, trigger unwanted state changes in the application. No authentication bypass is required—the attacker leverages the user's existing session. Patches should implement anti-CSRF tokens, convert GET operations to POST, and enforce SameSite cookie attributes.

Affected products

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0

Timeline

2026-09-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.