CVE-2026-1154

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A flaw has been found in SourceCodester E-Learning System 1.0. This impacts an unknown function of the file /admin/modules/lesson/index.php of the component Lesson Module Handler. Executing a manipulation of the argument Title/Description can lead to basic cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-74 CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Jan 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-115405.3IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the CVE-2026-1154004.4crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OA CVE-2026-115419.8IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Appl CVE-2026-1154115.0crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block CVE-2026-1154147.8OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration CVE-2026-1154167.7Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS accou CVE-2026-1154177.5Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote act CVE-2026-1154198.1The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 doe CVE-2026-1154245.5A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly CVE-2026-1154493.5A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the h CVE-2026-115453.7IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console d CVE-2026-1154507.1External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an a