What is the CVSS score of CVE-2026-4235?

CVE-2026-4235 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-4235?

Yes, a public proof-of-concept exploit is available for CVE-2026-4235. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4235?

Within 24 hours: Isolate affected systems from production, disable the /sms/login.php endpoint if possible, and alert relevant stakeholders. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns, implement input validation, and conduct a database audit for unauthorized access. Within 30 days: Evaluate alternative enrollment systems, plan migration strategy, and work with vendor for security patches or replacement timeline.

Online Enrollment System CVE-2026-4235

EUVD-2026-12403 MEDIUM

SQL Injection (CWE-89)

2026-03-16 VulDB

PHP SQLi Online Enrollment System Itsourcecode

5.5

CVSS 4.0 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send HTTP request to /sms/login.php
Exploit

Inject SQL payload into user_email parameter
Execution

Execute unauthorized database queries
Impact

Extract sensitive data or modify records

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions — remote unauthenticated exploitation against default installations of itsourcecode Online Enrollment System 1.0 with /sms/login.php accessible.
Impact	Despite the moderate CVSS score of 7.3, this vulnerability presents a high real-world risk due to several factors from the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicating network-accessible, low complexity attacks requiring no privileges or user interaction. The existence of a public exploit (E:P) significantly increases the threat level, as indicated by the exploit maturity metric. While no EPSS score or KEV listing is mentioned, the combination of remote exploitability, no authentication requirement, and public POC availability makes this a priority for remediation. The SSVC framework would likely classify this as requiring immediate action given the public exploit, remote attack vector, and potential for automated exploitation.
Exploit ScenarioDerived	An attacker can remotely send a crafted HTTP request to the /sms/login.php endpoint with malicious SQL code in the user_email parameter, bypassing authentication and potentially extracting sensitive student enrollment data or gaining administrative access. The public exploit code available on GitHub provides a ready-made attack tool that requires minimal technical skill to execute. Given the low attack complexity and no authentication requirements, this vulnerability could be easily incorporated into automated scanning tools or botnet attacks targeting educational institutions.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate the user_email parameter in /sms/login.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, enabling attackers to read, modify, or delete sensitive enrollment data without authentication. No patch is currently available.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 12:00 CVSS 7.3

A SQL injection vulnerability exists in the /sms/login.php file of itsourcecode Online Enrollment System version 1.0, where improper handling of the user_email parameter allows remote attackers to inject malicious SQL queries without authentication. A public proof-of-concept exploit is available on GitHub, making this vulnerability easily exploitable by attackers to potentially access, modify, or delete database contents. The vulnerability has a moderate CVSS score of 7.3 but represents a significant risk due to the public exploit availability and the ease of remote exploitation.

RemediationAI

No official patch or updated version is currently mentioned in the available references, leaving users of Online Enrollment System 1.0 exposed. As immediate mitigation, administrators should implement a Web Application Firewall (WAF) with SQL injection detection rules, particularly monitoring the /sms/login.php endpoint and user_email parameter. Input validation and parameterized queries should be implemented in the login.php file if source code access is available. Given the public exploit availability at https://github.com/yuji0903/silver-guide/issues/11, affected systems should be considered compromised and undergo security review.

Affected VersionsENISA

Online Enrollment System 1.0

Affected Packages

euvd online_enrollment_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability affects itsourcecode Online Enrollment System 1.0 (CPE: cpe:2.3:a:itsourcecode:online_enrollment_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing student enrollments. The issue is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which occurs when user-supplied input is concatenated directly into SQL queries without proper sanitization or parameterization. The login.php file fails to properly validate or escape the user_email parameter before using it in database queries, allowing attackers to inject arbitrary SQL commands that the database will execute.

Know when Online Enrollment System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 22, 2026 - 21:37 NVD

HIGH MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

CVE Published

Mar 16, 2026 - 11:02 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in itsourcecode Online Enrollment System 1.0. This issue affects some unknown processing of the file /sms/login.php. This manipulation of the argument user_email causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Executive ViewAI

Why It Matters

A remote SQL injection vulnerability in the Online Enrollment System's login function exposes our database to unauthorized access, modification, or deletion without requiring authentication. With a public exploit readily available, this vulnerability poses an immediate threat to student data, enrollment records, and system integrity, requiring urgent remediation.

Business Impact: Severe

Compensating Controls

Deploy WAF rules specifically blocking SQL injection signatures in the user_email parameter; implement database access controls and monitoring; disable the vulnerable login feature if alternative authentication exists; segment the enrollment system from other critical infrastructure; enable comprehensive logging and alerting for login attempts; consider implementing rate limiting and CAPTCHA challenges.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.