Online Reviewer System CVE-2026-109620

No special conditions - remote unauthenticated exploitation of the pre-authentication login form (login/index.php) in SourceCodester Online Reviewer System 1.0; the attacker only needs network reachability to the application's login endpoint and supplies malicious input in the username or password field. The only practical limiting factor is deployment itself: the target must be running this specific SourceCodester product version 1.0 and have the login page network-accessible. No authentication, user interaction, or non-default configuration is required, consistent with PR:N/UI:N.

Signals are mostly consistent and point to a genuine but moderate-severity issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remotely reachable, low-complexity, unauthenticated flaw, which is the worst-case combination for reachability; however, impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change, yielding a medium base score of 6.9. The input carries no EPSS score and no CISA KEV listing, so there is no evidence of widespread or confirmed active exploitation - status is 'publicly available exploit code exists,' which is a distinct and weaker signal than in-the-wild use. The CVSS 4.0 exploit maturity sub-metric E:P (Proof-of-Concept) corroborates that only POC-grade code is known. Net: this is a real, easily triggered pre-authentication SQL injection, but its real-world priority is tempered by a niche, non-enterprise product footprint and the absence of KEV/EPSS escalation signals. For organizations actually running SourceCodester Online Reviewer System it should be patched promptly; for the broader population it is low-priority due to minimal deployment.

A remote, unauthenticated attacker submits a crafted username or password value to login/index.php, injecting SQL that is passed into the PDO::prepare query, allowing authentication bypass or extraction of database contents such as administrator credentials. A public proof-of-concept exists (hosted at tracexlabs.com and catalogued by VulDB), lowering the skill required; with AV:N/AC:L/PR:N/UI:N no special access, user interaction, or timing is needed. Because impact is rated Low, the realistic outcome is limited data disclosure or login bypass rather than full host compromise.