CVE-2026-90877

HighCVSS 7.3

Published: 15/09/2026(UTC)Updated: 15/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in SQL injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Risk Assessment

The vulnerability allows a remote attacker to inject arbitrary SQL queries, potentially leading to data leakage or modification. The risk is high because the exploit is publicly available.

Recommendation

Update the software to the latest version if available. Otherwise, implement fixes to filter the haydi argument and restrict access to /update_requirement_status.php.

Other vulnerabilities in Online Faculty Clearance System

CVE-2026-90876High
A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Original NVD description (English source)

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS