CVE-2026-105182
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A security flaw was discovered in SourceCodester Online Reviewer Management System 1.0 affecting an unknown function of /reviewer_0/admins/assessments/activities/btn_functions.php?action=update. Manipulating the Title argument results in SQL injection, and the attack may be performed remotely. The exploit has been released to the public and may be used for attacks.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, risking data leakage or modification. Public release of the exploit increases the risk of exploitation.
Recommendation
Immediately implement parameterized queries and validate the Title argument in btn_functions.php, and restrict access to the administrative panel.
Other vulnerabilities in Online Reviewer Management System
See all- CVE-2026-105247High
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-105246High
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argument Subject results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- CVE-2026-102910High
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test_id results in SQL injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-93974High
A flaw has been found in SourceCodester Online Reviewer Management System 1.0 in the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely and the exploit has been published.
- CVE-2026-93973High
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0 in the file /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove. Manipulating the ID argument results in SQL injection. The attack can be initiated remotely and the exploit is now public.
- CVE-2026-93972High
A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0 in the file /reviewer_0/admins/assessments/course/btn_functions.php. Manipulating the courseID argument leads to SQL injection. The attack can be launched remotely and the exploit has been disclosed publicly.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=update. The manipulation of the argument Title results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS