CVE-2026-104606
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A SQL injection vulnerability was discovered in itsourcecode Online Admission System 1.0 in the confirm.php file. Manipulation of the ID argument allows remote attacks. The exploit has been publicly released.
Risk Assessment
An attacker can remotely manipulate database queries, potentially leading to unauthorized data access or modification. The public exploit increases the risk of active exploitation.
Recommendation
Apply patches immediately or secure the application against SQL injection, e.g., by using parameterized queries. Restrict access to confirm.php.
Other vulnerabilities in itsourcecode Online Admission System
See all- CVE-2026-108928Medium
A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-105254Medium
A vulnerability was identified in itsourcecode Online Admission System 1.0. It impacts an unknown function in the file /admin/schoolyear.php. Manipulation of the sy argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS