Campcodes Complete Online Learning Management System version 1.0 contains a flaw in the add_lesson function of Crud_model.php that allows an attacker to upload arbitrary files to the server. This vulnerability is a classic example of improper access control and unrestricted file upload, as indicated by CWE-284 and CWE-434. Successfully exploiting it can enable an attacker to place malicious scripts or binaries on the platform, potentially leading to remote code execution or further compromise of the system's confidentiality and integrity.

The affected system is Campcodes Complete Online Learning Management System, version 1.0.

The CVSS score of 5.3 suggests moderate severity, and the exploit has been published, indicating that attackers could target the application over the network. Although no EPSS score is available and the vulnerability is not listed in the KEV catalog, the remote nature of the attack and the presence of a published exploit increase the likelihood of real‑world exploitation. The attack vector is inferred to be a remote web request that submits a file through the add_lesson interface, requiring no additional privileges beyond access to the upload form.