The vulnerability in SourceCodester’s Onlne Examination & Learning Management System allows an attacker to upload arbitrary files through the /announcements.php endpoint without any file type, size, or content validation. Because the upload path is exposed without authentication, an unauthenticated user can place any file on the server. The flaw is identified as CWE‑434 (Unrestricted Upload) and CWE‑284 (Improper Access Control). While the description does not confirm that the uploaded files are necessarily executed, if the server stores them in a web‑executable directory, malicious code could potentially be run, leading to remote code execution.

Affects SourceCodester Onlne Examination & Learning Management System version 1.0 as listed by the CNA. The vulnerability involves the /announcements.php script and no other product versions or sub‑components are mentioned.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1 % shows a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The attack vector is a remote HTTP request to the /announcements.php endpoint, allowing an unauthenticated attacker to upload crafted files. Whether an attacker gains remote code execution depends on how the server handles uploaded content—specifically whether the files are stored in an executable or web‑accessible location.