Is there a public PoC exploit available for CVE-2026-9383?

Yes, a public proof-of-concept exploit is available for CVE-2026-9383. Prioritise patching immediately. EPSS: 0.0%.

Electronic Judging System CVE-2026-9383

Q: What is the CVSS score of CVE-2026-9383?

CVE-2026-9383 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31595 MEDIUM

SQL Injection (CWE-89)

2026-05-24 VulDB

GHSA-f6vh-g669-h27x

PHP SQLi Electronic Judging System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:05 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:37 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/admin/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Electronic Judging System 1.0 exposes the admin login endpoint at /intrams/admin/login.php to unauthenticated remote attackers who can manipulate the Username parameter to alter backend SQL query logic. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is exploitable over the network with no privileges or user interaction, and publicly available exploit code (E:P) further lowers the barrier to entry. Although EPSS sits at 0.03% (9th percentile) indicating low observed exploitation activity, no vendor patch has been identified at time of analysis, leaving all known deployments of version 1.0 without an official remediation path.

Technical ContextAI

The affected product is itsourcecode Electronic Judging System 1.0, a PHP-based academic competition management application (CPE: cpe:2.3:a:itsourcecode:electronic_judging_system:*:*:*:*:*:*:*:*). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: user-supplied input in the Username parameter of the admin login form at /intrams/admin/login.php is passed into a backend SQL query without adequate sanitization or parameterization. This is a classic unsanitized string concatenation flaw in PHP database interaction, where attacker-controlled characters such as single quotes alter the intended query structure, enabling logic manipulation (e.g., authentication bypass) or data extraction (e.g., UNION-based or error-based exfiltration).

RemediationAI

No vendor-released patch has been identified at time of analysis; monitor VulDB (https://vuldb.com/vuln/365346) and itsourcecode (https://itsourcecode.com/) for updates. As an immediate compensating control, restrict network access to /intrams/admin/login.php using web server IP allowlisting (e.g., Apache's Require ip directive or nginx's allow/deny blocks), limiting administrative login to trusted management networks - note this will block legitimate remote admin access as a trade-off. Deploy a WAF rule targeting SQL injection signatures (single quotes, UNION, comment sequences) in the Username parameter to detect and block exploitation attempts; be aware WAF rules can produce false positives and may require tuning. If source code access is available, the root fix is to replace raw string concatenation in the login query with PHP PDO or MySQLi prepared statements and bound parameters - this eliminates the injection surface entirely. Disable or rename the admin login path if administrative access is not required from external networks.