PT-2026-31924 · Itsourcecode · Online Student Enrollment System

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-36235

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'subjcode' parameter is directly embedded into the SQL query via string interpolation without any sanitization or validation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-36235

Affected Products

Online Student Enrollment System

References · 2

• 🔥 https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_scheduleSubList.php_sql_injection.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36235 · Security Note