CVE-2026-15539 MEDIUM

CVE-2026-15539: SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload

Vendor Sourcecodester
Product Online Book Store System
Weakness CWE-434 · Unrestricted file upload
Published July 13, 2026
Last update July 13, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Key dates

02Disclosure timeline

July 13, 2026 CVE published
July 13, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-12476 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter CVE-2026-63048 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 CVE-2026-18933 wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal CVE-2026-39527 WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability CVE-2026-39591 WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability