CVE-2026-105254
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was identified in itsourcecode Online Admission System 1.0. It impacts an unknown function in the file /admin/schoolyear.php. Manipulation of the sy argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
The SQL injection vulnerability may allow an attacker to manipulate the database, potentially leading to data disclosure, modification, or full system compromise.
Recommendation
It is recommended to immediately apply patches or update the system, and implement input validation.
Other vulnerabilities in itsourcecode Online Admission System
See all- CVE-2026-108928Medium
A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-104606Medium
A SQL injection vulnerability was discovered in itsourcecode Online Admission System 1.0 in the confirm.php file. Manipulation of the ID argument allows remote attacks. The exploit has been publicly released.
Original NVD description (English source)
A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS