PT-2026-4727 · Unknown · Online Examination System

Geochen · Published 2026-01-26 · Updated 2026-01-31 · CVE-2026-1422

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Online Examination System version 1.0

Description A flaw exists in the Online Examination System that allows for remote SQL injection. This occurs through manipulation of the User argument within the /index.php file, specifically related to the Login Page component. The exploit for this issue has been publicly disclosed.

Recommendations Apply any available updates or patches to address the SQL injection vulnerability in the /index.php file. As a temporary workaround, consider restricting or carefully validating the User input parameter to prevent malicious SQL code injection.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-1422

Affected Products

Online Examination System

References · 13

• 🔥 https://github.com/geo-chen/code-projects/blob/main/Online%20Examination%20System%20In%20PHP%20With%20Source%20Code.md#finding-2-sql-injection-on-login-page · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1422 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1422 · Vendor Advisory
• https://twitter.com/cracbot/status/2017553491552874609 · Twitter Post
• https://code-projects.org · Note
• https://t.me/cveNotify/149832 · Telegram Post
• https://twitter.com/cracbot/status/2017191113543807118 · Twitter Post
• https://vuldb.com/?id.342838 · Note
• https://vuldb.com/?submit.736606 · Note
• https://t.me/CVEtracker/42986 · Telegram Post
• https://t.me/cveNotify/150135 · Telegram Post
• https://vuldb.com/?ctiid.342838 · Note
• https://twitter.com/CVEnew/status/2015673749035520214 · Twitter Post