Is there a public PoC exploit available for CVE-2026-15672?

Yes, a public proof-of-concept exploit is available for CVE-2026-15672. Prioritise patching immediately. EPSS: 0.2%.

Electronic Judging System CVE-2026-15672

Q: What is the CVSS score of CVE-2026-15672?

CVE-2026-15672 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43622 LOW

SQL Injection (CWE-89)

2026-07-14 VulDB

GHSA-2jvg-8jmq-6pwc

PHP SQLi Electronic Judging System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQL injection requiring low-privilege admin authentication; bounded CIA impact within the application database with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 06:31 vuln.today

Severity Changed

Jul 14, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jul 14, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 14, 2026 - 05:30 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This manipulation of the argument fname causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in itsourcecode Electronic Judging System 1.0 exposes the admin panel endpoint /intrams/admin/add_judges.php to database manipulation via the unsanitized fname parameter. Authenticated remote attackers can craft malicious input to read, alter, or potentially enumerate backend database contents. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 base score of 2.1 (Low), reflecting the authenticated access prerequisite and limited-scope CIA impact.

Technical ContextAI

This is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in a PHP-based web application. The admin page add_judges.php incorporates the fname form parameter directly into an SQL query without sanitization or parameterization, enabling classic SQL injection. The affected product is identified by CPE cpe:2.3:a:itsourcecode:electronic_judging_system:*:*:*:*:*:*:*:*, with a wildcard version string suggesting all known releases of the itsourcecode Electronic Judging System are affected. The application is a PHP-driven judging management portal, likely backed by MySQL or MariaDB.

RemediationAI

No vendor-released patch has been identified at time of analysis. The recommended permanent fix is to refactor the SQL query in /intrams/admin/add_judges.php to use parameterized prepared statements (e.g., PHP PDO or MySQLi with bound parameters), which eliminates the injection surface entirely. As interim compensating controls: restrict access to the /intrams/admin/ directory to trusted IP ranges using server-level ACLs or .htaccess rules (trade-off: may block legitimate remote admins); deploy a WAF rule to detect and block common SQL injection patterns in POST parameters (trade-off: signature bypass is possible with advanced payloads); and enforce strong, unique credentials for all admin accounts to raise the authentication barrier. The public POC is documented at https://github.com/sjmycz/cve/issues/1 and can be used to validate remediation.