CVE-2026-102910
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test_id results in SQL injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion in the database.
Recommendation
Implement input validation and parameterized SQL queries in exam-delete.php, restrict access to the application, and consider replacing the unmaintained system.
Other vulnerabilities in Online Reviewer Management System
See all- CVE-2026-105247High
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-105246High
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argument Subject results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- CVE-2026-105182High
A security flaw was discovered in SourceCodester Online Reviewer Management System 1.0 affecting an unknown function of /reviewer_0/admins/assessments/activities/btn_functions.php?action=update. Manipulating the Title argument results in SQL injection, and the attack may be performed remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-93974High
A flaw has been found in SourceCodester Online Reviewer Management System 1.0 in the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely and the exploit has been published.
- CVE-2026-93973High
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0 in the file /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove. Manipulating the ID argument results in SQL injection. The attack can be initiated remotely and the exploit is now public.
- CVE-2026-93972High
A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0 in the file /reviewer_0/admins/assessments/course/btn_functions.php. Manipulating the courseID argument leads to SQL injection. The attack can be launched remotely and the exploit has been disclosed publicly.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test_id results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS