CVE-2026-104123
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The manipulation of the Title argument in the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity results in SQL injection. The attack can be launched remotely, and the exploit is now public.
Risk Assessment
An attacker can exploit the vulnerability to gain unauthorized access to the database, leak data, modify or delete records, potentially compromising system integrity.
Recommendation
Immediately apply patches provided by the vendor or restrict access to the vulnerable file. Also conduct a security audit and implement parameterized SQL queries.
Other vulnerabilities in SourceCodester Online Reviewer Management System
See all- CVE-2026-102909High
A SQL injection vulnerability was identified in SourceCodester Online Reviewer Management System 1.0, specifically in the file /reviewer_0/admins/assessments/examproper/btn_functions.php. Manipulation of the access_code argument allows SQL injection. The attack can be performed remotely and a public exploit is already available.
- CVE-2026-102908High
A SQL injection vulnerability was found in SourceCodester Online Reviewer Management System 1.0, in the file /reviewer_0/admins/assessments/examproper/questions-view.php. Manipulation of the ID argument allows SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-95927High
SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 in file /reviewer_0/admins/assessments/pretest/exam-delete.php. Manipulation of argument test_id allows remote SQL injection.
- CVE-2026-95926High
SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 in file /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update. Manipulation of argument test_id allows remote SQL injection.
- CVE-2026-95925High
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=update. Manipulation of the argument difficulty_id results in SQL injection. The attack can be executed remotely, and the exploit has been made public.
- CVE-2026-95924High
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed publicly.
- CVE-2026-93959High
Vulnerability in SourceCodester Online Reviewer Management System 1.0 affects unknown processing in /reviewer_0/admins/assessments/course/btn_functions.php. Manipulation of the Course argument causes SQL injection. The attack can be remote, and the exploit is public.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS