Is there a public PoC exploit available for CVE-2026-9528?

Yes, a public proof-of-concept exploit is available for CVE-2026-9528. Prioritise patching immediately. EPSS: 0.0%.

Electronic Judging System CVE-2026-9528

Q: What is the CVSS score of CVE-2026-9528?

CVE-2026-9528 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31785 MEDIUM

SQL Injection (CWE-89)

2026-05-26 VulDB

GHSA-fvc6-f4jx-rh3v

PHP SQLi Electronic Judging System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:31 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:07 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /admin/delete_judge.php. Such manipulation of the argument judge_id leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Electronic Judging System 1.0 exposes the /admin/delete_judge.php endpoint to remote unauthenticated attackers who can manipulate the judge_id parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no prerequisites are required to reach the vulnerable parameter, and a publicly available proof-of-concept exploit exists on GitHub, corroborated by the CVSS 4.0 exploit maturity modifier E:P. Despite these factors, EPSS sits at 0.03% (9th percentile), indicating no public exploit has yet driven widespread opportunistic scanning; no KEV listing confirms active exploitation in the wild at time of analysis.

Technical ContextAI

Electronic Judging System 1.0 is a PHP-based web application distributed by itsourcecode (cpe:2.3:a:itsourcecode:electronic_judging_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection arising from unsanitized user-controlled input being concatenated directly into a SQL query within /admin/delete_judge.php. The judge_id parameter, intended to identify a judge record for deletion, is passed without parameterized queries or prepared statements, allowing an attacker to append arbitrary SQL clauses. PHP applications relying on direct database query construction without input validation or ORM-level escaping are a well-understood attack surface for this vulnerability class.

RemediationAI

No vendor-released patch has been identified at time of analysis - the available references point to a VulDB report (https://vuldb.com/vuln/365547) and an NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-9528), neither of which documents a fixed version. Organizations running Electronic Judging System 1.0 should apply compensating controls immediately: restrict access to /admin/delete_judge.php at the web server or WAF layer to only trusted, authenticated administrator IP ranges, accepting the trade-off that this may inconvenience remote admins. Deploy a WAF rule to detect and block SQL metacharacter sequences (single quotes, comment syntax, UNION/SELECT patterns) in the judge_id parameter, noting WAF rules can produce false positives if judge_IDs contain legitimate special characters. If the delete functionality is non-essential to day-to-day operations, disabling the endpoint entirely via web server configuration is the most decisive interim control. Monitor database query logs for anomalous DELETE or SELECT patterns originating from the admin interface. Organizations should contact the itsourcecode vendor directly for a patched release timeline.