CVE-2026-1423 is a medium severity unrestricted file upload (CVSS 6.3) in code-projects Online Examination System 1.0. The /admin_pic.php file accepts uploads without enough checks, and a low privilege login is needed. No fix is confirmed, so keep it off the internet and restrict uploads.
What's affected
The record names code-projects Online Examination System version 1.0. The affected file is /admin_pic.php. The record names no fixed version, and we found no vendor advisory. The researcher write up that the record links describes the impact as remote code execution through unsafe upload, though we did not fetch the exploit detail and give none here.
How to check if you're exposed
Find any copy of the application and open admin_pic.php. If it saves an uploaded file into a web served folder without checking type, name and content, it is the flaw. Look in the upload folder for files that are not images, especially script files.
Check web server logs for requests to files in that folder.
What to do now
- Find any copy of Online Examination System 1.0 in your environment.
- Take internet facing copies offline or behind a VPN.
- Block script execution in the upload folder at the web server level.
- Check the upload folder for files that should not be there and remove them.
- Replace the application with a maintained one, or add strict type checks and store uploads outside the web root.
Why it matters
Upload handlers must decide what a file really is, where it is stored and whether the server may run it. When any of those is skipped, an uploaded script can land in a place the web server executes. The record lists CWE-284 and CWE-434, improper access control and unrestricted upload of a file with a dangerous type.
The record says the exploit has been publicly disclosed and may be utilized. It does not flag the CVE as known exploited. The defenses are standard: allow only expected types, rename files, store them outside the web root and never run uploads.
The record lists these weakness classes: CWE-284 (Improper Access Control), CWE-434 (Unrestricted Upload of File with Dangerous Type).
Quick check
What is the simplest mitigation?
Turn off script execution in the upload directory and keep the application away from the internet until it is replaced or fixed.
Sources
Last reviewed: 19 October 2026.
