CVE-2026-6573

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.master.php of the component Instant Exam Creation Handler. The manipulation of the argument uploadfile results in server-side request forgery. The attack can be executed remotely. The exploit is now public and may be used.

Published 2026-04-19. Last modified 2026-06-17.