CVE-2026-15540
MEDIUMSourceCodester Online Book Store System Administrative index.php php file inclusion
Title source: cnaDescription
A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/require statement in php program. It is possible to initiate the attack remotely. The exploit is now public and may be used.
References (6)
Core 6
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-377890 | SourceCodester Online Book Store System Administrative index.php php file inclusion
https://vuldb.com/vuln/377890
Signature, Permissions Required signature
permissions-required
VDB-377890 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/377890/cti
Third Party Advisory third-party-advisory
CVE-2026-15540 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15540
Third Party Advisory third-party-advisory
Submit #855048 | SourceCodester Online Book Store System 1.0 Local File Inclusion
https://vuldb.com/submit/855048
Exploit broken-link
exploit
https://medium.com/@hemantrajbhati5555/local-file-inclusion-lfi-via-page-parameter-leading-to-source-code-disclosure-ce722de0c407
Product product
https://www.sourcecodester.com/
Scores
CVSS v3
4.3
EPSS
0.0024
EPSS Percentile
15.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-73
CWE-98
Status
published
Products (1)
SourceCodester/Online Book Store System
1.0
Published
Jul 13, 2026
Tracked Since
Jul 13, 2026