CVE-2026-1154 MEDIUM

CVE-2026-1154: SourceCodester E-Learning System Lesson index.php cross site scripting

Vendor Sourcecodester

Product E-Learning System

Weakness CWE-80 · XSS · basic

Published January 19, 2026

Last update February 23, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in SourceCodester E-Learning System 1.0. This impacts an unknown function of the file /admin/modules/lesson/index.php of the component Lesson Module Handler. Executing a manipulation of the argument Title/Description can lead to basic cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.

Key dates

02Disclosure timeline

January 19, 2026 CVE published

February 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-1154 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/80.html