CVE-2026-86280 Details
Description
A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This affects an unknown function of the file cict_portal.sql. Such manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
A vulnerability exists in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0, specifically within the file 'cict_portal.sql'. This vulnerability allows for the cleartext storage of sensitive information, including database credentials and personal identifiable information (PII) of students and staff. The issue can be exploited remotely, and the public availability of the exploit increases the risk of misuse.
Remove hardcoded credentials from 'db.php' and replace them with environment variables. Sanitize the SQL dump before distribution to remove real PII and replace it with anonymized data. Set a strong password for the MySQL root user and create a dedicated, limited-privilege MySQL user for the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hackliu/Vulnerability-Reports/blob/master/Syllabus%20Aligned%20Learning%20Management%20Examination%20System/VULN-07-Sensitive-Information-Exposure.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-86280 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/904881 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399441 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399441/cti | [email protected] | AdvisoryPermission Required |
| https://www.sourcecodester.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-310 | Cryptographic Issues | [email protected] |
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SourceCodester Syllabus-Aligned Learning Management & Examination System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |