CVE-2026-91004

HighCVSS 7.3

Published: 15/09/2026(UTC)Updated: 15/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

In SourceCodester Online Faculty Clearance System 1.0, a SQL injection vulnerability exists in an unknown function of the file /delete_faculty1.php, through manipulation of the ID argument. The attack can be executed remotely, and the exploit has been disclosed publicly.

Risk Assessment

Risk of unauthorized database access, data leakage, or modification, potentially leading to confidentiality and integrity breaches.

Recommendation

Upgrade the system to a patched version or apply proper mitigations such as parameterized queries. Restrict access to /delete_faculty1.php.

Other vulnerabilities in SourceCodester Online Faculty Clearance System

CVE-2026-91005Medium
A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0 in the move_uploaded_file function of production/edit_picture.php in the Profile Picture Upload component. Manipulating the File argument results in unrestricted file upload. The attack can be carried out remotely and a public exploit is available.

Original NVD description (English source)

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS