CVE-2026-15539

SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload

CVSS 5.1 MEDIUMCWE-284 CWE-434

Vexday Risk Score

10Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.1EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

SourceCodester · Online Book Store System

References

https://medium.com/@hemantrajbhati5555/critical-authenticated-remote-code-execution-rce-via-unrestricted-file-upload-5a4a313ea1f1 https://vuldb.com/cve/CVE-2026-15539 https://vuldb.com/submit/855046 https://vuldb.com/vuln/377889 https://vuldb.com/vuln/377889/cti https://www.sourcecodester.com/