PT-2026-31930 · Itsourcecode · Online Student Enrollment System

CVE-2026-36233 · Published 2026-04-10 · Updated 2026-04-10

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that attackers can inject malicious code via the parameter "subjcode" and use it directly in SQL queries without the need for appropriate cleaning or validation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-36233

Affected Products

Online Student Enrollment System

References · 2

• 🔥 https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_assignInstructorSubjects.php_sql_injection.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36233 · Security Note