CVE-2026-95924
HighCVSS 7.3Summary
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed publicly.
Risk Assessment
An attacker can remotely exploit the vulnerability to perform SQL injection, potentially leading to data integrity compromise or unauthorized access. The public exploit increases the risk of attack.
Recommendation
Apply patches or restrict access to the vulnerable file. Also, use parameterized queries.
Other vulnerabilities in SourceCodester Online Reviewer Management System
See all- CVE-2026-95927High
SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 in file /reviewer_0/admins/assessments/pretest/exam-delete.php. Manipulation of argument test_id allows remote SQL injection.
- CVE-2026-95926High
SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 in file /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update. Manipulation of argument test_id allows remote SQL injection.
- CVE-2026-95925High
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=update. Manipulation of the argument difficulty_id results in SQL injection. The attack can be executed remotely, and the exploit has been made public.
- CVE-2026-93959High
Vulnerability in SourceCodester Online Reviewer Management System 1.0 affects unknown processing in /reviewer_0/admins/assessments/course/btn_functions.php. Manipulation of the Course argument causes SQL injection. The attack can be remote, and the exploit is public.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.