PT-2026-31924 · Itsourcecode · Online Student Enrollment System

Publicado 2026-04-10 · Atualizado 2026-04-10 · CVE-2026-36235

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'subjcode' parameter is directly embedded into the SQL query via string interpolation without any sanitization or validation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-36235

Produtos afetados

Online Student Enrollment System

Referências · 2

• 🔥 https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_scheduleSubList.php_sql_injection.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36235 · Nota de Segurança