CVE-2026-108974

A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.

Score

CVSS 3.1 7.3 High

Status

Deferred - cna@vuldb.com

Published

2026-10-13

Last modified

2026-10-16

Weaknesses

CWE-284, CWE-434

Affected products

• E-learning System (Sourcecodester)

References

• https://vuldb.com/vuln/416793
• https://vuldb.com/vuln/416793/cti
• https://vuldb.com/cve/CVE-2026-108974
• https://vuldb.com/submit/1000528
• https://tracexlabs.com/releases/elearning-preauth-rce.html
• https://www.sourcecodester.com/