CVE-2026-105253
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A SQL Injection vulnerability was found in itsourcecode Online Admission System Project 1.0 within the file /admin/login1.php, caused by improper handling of the User argument. The flaw can be exploited remotely and a public exploit is already available.
Risk Assessment
An attacker can remotely inject SQL queries, potentially leading to data leakage, modification or deletion, and authentication bypass. Since the exploit is public, the risk of rapid exploitation is high.
Recommendation
Update the system to a non-vulnerable version or apply the vendor's patch as soon as possible. Until then, consider disabling or restricting access to /admin/login1.php and deploy WAF rules to filter SQL Injection attempts.
Other vulnerabilities in Online Admission System
See all- CVE-2026-105187Medium
SQL injection vulnerability in itsourcecode Online Admission System 1.0. Affects the file /admin/key.php, where manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit is public.
- CVE-2026-105186Medium
SQL injection vulnerability in itsourcecode Online Admission System 1.0. Affects the file /new.php, where manipulation of the schedid argument leads to SQL injection. The attack can be executed remotely, and the exploit is public.
- CVE-2026-105185High
A vulnerability was detected in itsourcecode Online Admission System 1.0 affecting an unknown function of /admin/examinee.php. Manipulating the ID argument results in SQL injection, and the attack can be initiated remotely. The exploit is now public and may be used.
- CVE-2026-105184High
A security vulnerability was detected in itsourcecode Online Admission System 1.0 affecting an unknown function of /admin/creteria.php. Manipulating the ID argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-105183High
A weakness was identified in itsourcecode Online Admission System 1.0 affecting an unknown function of /admin/confirm.php. Manipulating the schedid argument causes SQL injection, and the attack can be initiated remotely. The exploit is publicly available and may be used for attacks.
- CVE-2026-105181Medium
SQL injection vulnerability in itsourcecode Online Admission System 1.0. Affects the file register1.php, where manipulation of the fname argument leads to SQL injection. The attack can be executed remotely, and the exploit is public.
- CVE-2026-105172High
SQL injection vulnerability in itsourcecode Online Admission System 1.0. Affects the file /login1.php, where manipulation of the User argument leads to SQL injection. The attack can be initiated remotely, and the exploit is public.
Original NVD description (English source)
A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS