CVE-2026-6573 - PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery

Back Back to CVE browser

MEDIUM

PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery

Published Apr 19, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.35%

Description

A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.master.php of the component Instant Exam Creation Handler. The manipulation of the argument uploadfile results in server-side request forgery. The attack can be executed remotely. The exploit is now public and may be used.

Affected products

Vendor Phpems Product Phpems Default
n/a
- Version
  11.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Phpems

n/a

Version	Status	Constraints
11.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23703
Advisory
https://vuldb.com/submit/789990
third-party-advisory
https://vuldb.com/vuln/358207
vdb-entrytechnical-description
https://vuldb.com/vuln/358207/cti
signaturepermissions-required
https://vulnplus-note.wetolink.com/share/1QZ4NE0oTRIc
broken-linkexploit

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23703		Advisory
https://vuldb.com/submit/789990		third-party-advisory
https://vuldb.com/vuln/358207		vdb-entrytechnical-description
https://vuldb.com/vuln/358207/cti		signaturepermissions-required
https://vulnplus-note.wetolink.com/share/1QZ4NE0oTRIc		broken-linkexploit