CVE-2026-93959
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in SourceCodester Online Reviewer Management System 1.0 affects unknown processing in /reviewer_0/admins/assessments/course/btn_functions.php. Manipulation of the Course argument causes SQL injection. The attack can be remote, and the exploit is public.
Risk Assessment
SQL injection could allow an attacker to access the database, steal data, or modify system content.
Recommendation
Upgrade the system or apply vendor patches immediately; if unavailable, restrict access to the application.
Other vulnerabilities in SourceCodester Online Reviewer Management System
See all- CVE-2026-95927High
SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 in file /reviewer_0/admins/assessments/pretest/exam-delete.php. Manipulation of argument test_id allows remote SQL injection.
- CVE-2026-95926High
SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 in file /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update. Manipulation of argument test_id allows remote SQL injection.
- CVE-2026-95925High
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=update. Manipulation of the argument difficulty_id results in SQL injection. The attack can be executed remotely, and the exploit has been made public.
- CVE-2026-95924High
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed publicly.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_functions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.