Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-6573: PHPEMS 11.0: Malicious File Upload Can Hijack Server Requests

CVE-2026-6573 · published 6 months ago

Summary

The PHPEMS 11.0 Instant Exam Creation Handler can be tricked into accepting and processing malicious files, allowing an attacker to control the server remotely. This could potentially lead to unauthorized actions. Update the PHPEMS software to a patched version as soon as possible to prevent exploitation.

Original advisory text

A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.master.php of the component Instant Exam Creation Handler. The manipulation of the argument uploadfile results in server-side request forgery. The attack can be executed remotely. The exploit is now public and may be used.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published19 Apr 2026

Updated4 Nov 2026

First seen19 Apr 2026

Sources

CVE-2026-6573 · NVD

Track software like this

Free during beta