Is there a public PoC exploit available for CVE-2026-9525?

Yes, a public proof-of-concept exploit is available for CVE-2026-9525. Prioritise patching immediately. EPSS: 0.0%.

Electronic Judging System CVE-2026-9525

Q: What is the CVSS score of CVE-2026-9525?

CVE-2026-9525 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31784 MEDIUM

SQL Injection (CWE-89)

2026-05-26 VulDB

GHSA-xcm5-3x32-738v

PHP SQLi Electronic Judging System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:55 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:07 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /admin/edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Electronic Judging System 1.0 exposes the /admin/edit_judge.php endpoint to unauthenticated remote attackers who can manipulate the judge_id parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS at 0.03% (9th percentile) reflects the product's limited deployment footprint rather than low technical severity - no public exploit identified at time of analysis as confirmed actively exploited (CISA KEV).

Technical ContextAI

The affected product is a PHP-based web application for managing electronic judging workflows, identified by CPE cpe:2.3:a:itsourcecode:electronic_judging_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the judge_id parameter passed to /admin/edit_judge.php is concatenated directly into a SQL query without parameterization or adequate sanitization. This is a classic first-order SQL injection pattern in PHP applications that fail to use prepared statements or PDO with bound parameters. The E:P modifier in the CVSS 4.0 vector confirms the existence of a public proof-of-concept, consistent with the GitHub disclosure referenced in the advisory.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor (itsourcecode.com) has not published a patched release as of the time of this assessment. As an immediate compensating control, restrict network access to /admin/edit_judge.php using IP allowlisting or web server access controls (e.g., Apache .htaccess or nginx allow/deny directives) to trusted administrative IPs only - note this limits legitimate remote admin access as a trade-off. Deploy a Web Application Firewall with SQL injection detection rules (e.g., ModSecurity with OWASP Core Rule Set) in blocking mode to filter malicious judge_id payloads - note WAFs can produce false positives and require tuning. Reduce the database account privileges assigned to the application to SELECT-only on non-sensitive tables where possible, limiting the blast radius of successful injection. The definitive fix requires code-level remediation: replacing string-concatenated queries in /admin/edit_judge.php with PHP PDO prepared statements or MySQLi parameterized queries. Monitor VulDB entry https://vuldb.com/vuln/365544 for vendor patch updates.