Online Examination System CVE-2026-108969

Requires a reachable instance of itsmeravitejak Online-Examination-System where an attacker can submit crafted cookname and cookid cookie values to the session-handling code path (Session::checkLogin). Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special configuration are stated as prerequisites - exploitation targets the default session validation logic. The primary limiting factor is deployment scarcity: this is an obscure open-source examination application with minimal production presence, and no fixed release exists because the project is rolling-release and the maintainer has not responded, so exposure depends entirely on whether an organization has deployed this specific software and exposed it to the attacker's network.

This is a low-to-moderate real-world risk despite the publicly disclosed exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but all impact metrics are only Low (VC:L/VI:L/VA:L), and the E:P maturity marker indicates a proof-of-concept rather than mature, automated exploitation - consistent with VulDB's conservative scoring of a CWE-697 incorrect-comparison defect in session cookie handling. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV, so there is no evidence of active exploitation; the only exploitation signal is publicly available exploit code (POC=YES). Weighing these signals together: the network/unauthenticated vector plus public POC warrants attention for anyone actually running this software, but the Low triad impact, absence of KEV listing, and the product's obscurity (a single-maintainer GitHub project) make this a far lower operational priority than its 6.9 score alone might suggest. Conflict to verify: the CVSS claims PR:N (unauthenticated) yet the defect is in login/session validation (Session::checkLogin) - the practical effect is likely an authentication/session bypass via crafted cookies, which is more impactful than the Low-only impact metrics imply; verify realistic impact against the actual code path.

A remote, unauthenticated attacker crafts manipulated cookname/cookid cookie values and sends them to the application; the flawed comparison in Session::checkLogin mis-validates the forged values, letting the attacker assume a session or access protected examination data without valid credentials. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), lowering the barrier to reproduction, though it reflects PoC-level maturity rather than weaponized tooling.