Is there a public PoC exploit available for CVE-2026-9526?

Yes, a public proof-of-concept exploit is available for CVE-2026-9526. Prioritise patching immediately. EPSS: 0.0%.

Electronic Judging System CVE-2026-9526

Q: What is the CVSS score of CVE-2026-9526?

CVE-2026-9526 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31786 MEDIUM

SQL Injection (CWE-89)

2026-05-26 VulDB

GHSA-2j8w-6h96-9r36

PHP SQLi Electronic Judging System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:29 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:07 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in itsourcecode Electronic Judging System 1.0. This vulnerability affects unknown code of the file /admin/edit_team.php. The manipulation of the argument num_id results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in itsourcecode Electronic Judging System 1.0 allows remote unauthenticated attackers to manipulate the num_id parameter in /admin/edit_team.php, enabling unauthorized database read, write, and partial availability impact. The CVSS 4.0 vector confirms no authentication or user interaction is required (PR:N/UI:N), and publicly available exploit code exists on GitHub - though EPSS remains very low at 0.03% (9th percentile), suggesting limited real-world exploitation interest consistent with a niche, low-adoption PHP application. The vulnerability is not listed in CISA KEV, but the SSVC framework flags it as automatable, meaning opportunistic scanning tools could exploit it at scale against any internet-exposed deployment.

Technical ContextAI

The affected product is itsourcecode Electronic Judging System version 1.0, a PHP-based web application (CPE: cpe:2.3:a:itsourcecode:electronic_judging_system:*:*:*:*:*:*:*:*) designed as an online judging platform, likely used in academic or competitive programming contexts. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection flaw arising from unsanitized user input being interpolated directly into database queries without use of parameterized statements or prepared queries. The vulnerable code path is the team editing admin feature at /admin/edit_team.php, where the num_id argument - likely a team or numeric identifier - is accepted from the request and passed unescaped into an SQL statement. This class of flaw in PHP applications typically results from direct use of $_GET/$_POST variables in query strings via mysqli_query() or similar without binding.

RemediationAI

No vendor-released patch has been identified at the time of analysis - absence of a patched version is confirmed by VulDB data, not merely absent from this report. For organizations self-hosting this PHP application with access to source code, the primary fix is replacing unsanitized query construction in /admin/edit_team.php with parameterized prepared statements (e.g., using mysqli_prepare() and bind_param() or PDO), which eliminates the root cause entirely. As a compensating control, restrict network access to the /admin/ directory using web server IP allowlisting or HTTP authentication at the server layer (e.g., Apache .htaccess or nginx allow/deny directives) - this does not fix the underlying flaw but prevents unauthenticated internet-facing access to the vulnerable endpoint, significantly reducing exposure. A WAF rule targeting SQL metacharacters in the num_id parameter provides additional layered defense, though WAF bypasses are feasible for determined attackers. If none of these controls can be applied, consider taking the admin panel offline until a code-level fix is implemented. Reference the public POC at https://github.com/i-QvQ-i/first-OvO/issues/2 and VulDB advisory at https://vuldb.com/vuln/365545 for technical reproduction details.