Is there a public PoC exploit available for CVE-2026-7555?

Yes, a public proof-of-concept exploit is available for CVE-2026-7555. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode Electronic Judging System CVE-2026-7555

Q: What is the CVSS score of CVE-2026-7555?

CVE-2026-7555 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26481 MEDIUM

SQL Injection (CWE-89)

2026-05-01 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 15:26 vuln.today

Public exploit code

Analysis Generated

May 01, 2026 - 06:30 vuln.today

Severity Changed

May 01, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

May 01, 2026 - 06:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

May 01, 2026 - 06:00 euvd

EUVD-2026-26481

Analysis Generated

May 01, 2026 - 06:00 vuln.today

CVE Published

May 01, 2026 - 05:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/login.php. Such manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Electronic Judging System 1.0 allows remote attackers to manipulate the Username parameter in /intrams/login.php, leading to unauthorized data access and modification. The vulnerability requires no authentication and can be exploited over the network with low complexity. Publicly available exploit code exists, and the CVSS 4.0 vector indicates confidentiality and integrity impact on the affected application.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) in the PHP-based login form handler. The /intrams/login.php endpoint fails to sanitize or parameterize the Username input before incorporating it into SQL queries. Attackers can inject malicious SQL syntax into the Username parameter to bypass authentication, extract database contents, or modify records. The CPE indicates all versions of itsourcecode Electronic Judging System are potentially affected, though version 1.0 is explicitly confirmed vulnerable. PHP applications using concatenated SQL queries without prepared statements are inherently susceptible to this class of attack.

RemediationAI

The primary remediation is to upgrade to a patched version released by itsourcecode; however, no vendor-released patch is independently confirmed at this time. Contact itsourcecode through https://itsourcecode.com/ to request security updates. As an immediate workaround, implement Web Application Firewall (WAF) rules to block common SQL injection payloads in the Username parameter (e.g., single quotes, UNION keywords, comment syntax). Additionally, restrict access to /intrams/login.php by IP address or network segment if the judging system is internal. Apply parameterized queries (prepared statements) in the PHP codebase to replace concatenated SQL construction; this requires code review and testing. For production systems unable to patch immediately, enable SQL query logging and real-time alerting on suspicious query patterns to detect exploitation attempts.