CVE-2026-95927
HighCVSS 7.3Summary
SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 in file /reviewer_0/admins/assessments/pretest/exam-delete.php. Manipulation of argument test_id allows remote SQL injection.
Risk Assessment
An attacker can exploit this to gain unauthorized access to the database, steal or modify data, potentially compromising confidentiality and integrity of the system.
Recommendation
Immediately validate and sanitize input (test_id parameter) and use parameterized queries (prepared statements).
Other vulnerabilities in SourceCodester Online Reviewer Management System
See all- CVE-2026-95926High
SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 in file /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update. Manipulation of argument test_id allows remote SQL injection.
- CVE-2026-95925High
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=update. Manipulation of the argument difficulty_id results in SQL injection. The attack can be executed remotely, and the exploit has been made public.
- CVE-2026-95924High
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed publicly.
- CVE-2026-93959High
Vulnerability in SourceCodester Online Reviewer Management System 1.0 affects unknown processing in /reviewer_0/admins/assessments/course/btn_functions.php. Manipulation of the Course argument causes SQL injection. The attack can be remote, and the exploit is public.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument test_id leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.