What is the CVSS score of CVE-2026-95927?

CVE-2026-95927 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-95927?

Yes, a public proof-of-concept exploit is available for CVE-2026-95927. Prioritise patching immediately. EPSS: 0.4%.

Online Reviewer CVE-2026-95927

EUVD-2026-84997 MEDIUM

SQL Injection (CWE-89)

2026-09-23 VulDB

GHSA-p8wm-c4c4-gpw8

PHP SQLi Online Reviewer Management System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach admin delete endpoint remotely
Exploit

Inject SQL via test_id parameter
Execution

Manipulate backend DELETE/SELECT query
Impact

Read or corrupt database records

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires the attacker to reach the specific endpoint /reviewer_0/admins/assessments/pretest/exam-delete.php and supply a manipulated test_id parameter. Although the CVSS vector states PR:N (no authentication), the file resides in the /admins/ administrative area, so in a properly configured deployment a valid admin session is likely a practical prerequisite; exploitation is further limited by the product's rare deployment footprint (SourceCodester Online Reviewer Management System 1.0, a demo/student PHP+MySQL application).
Impact	This is a classic high-nominal/low-real-risk finding. The CVSS 4.0 base score of 6.9 (Medium) reflects a network-reachable, low-complexity SQL injection (AV:N/AC:L/AT:N), but VulDB deliberately scored the impact as only partial across all three dimensions (VC:L/VI:L/VA:L) rather than the VC:H typical of extractable SQLi, which caps the score. The vector embeds E:P (Proof-of-Concept), consistent with the publicly available exploit on GitHub - publicly available exploit code exists, but this is NOT active exploitation: there is no CISA KEV listing and no EPSS score was provided. The single most important mitigating signal is prevalence: SourceCodester projects are free student/demo PHP applications with essentially no production footprint, so despite an unauthenticated remote vector on paper, real-world exposure is minimal. NOTE A CONFLICT: the CVSS vector asserts PR:N (unauthenticated), yet the vulnerable file lives under an /admins/ administrative directory (/reviewer_0/admins/assessments/pretest/exam-delete.php), which normally implies an authenticated admin context - this discrepancy should be verified against the source code, as VulDB scoring for these submissions is frequently over-optimistic on PR.
Exploit ScenarioDerived	A remote attacker sends a crafted request to /reviewer_0/admins/assessments/pretest/exam-delete.php with a malicious test_id parameter, injecting SQL into the delete query to read, alter, or destroy database records. A public proof-of-concept is available on GitHub (huliangjia/cve issue #8), lowering the skill barrier, though the endpoint's placement under an admin path may require a valid session in a correctly deployed instance.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

SQL injection in SourceCodester Online Reviewer Management System 1.0 allows attackers to manipulate the test_id parameter in /reviewer_0/admins/assessments/pretest/exam-delete.php, potentially reading or altering database contents. Publicly available exploit code exists, but practical exploitation requires reaching the administrative interface and likely a valid admin session despite the CVSS 4.0 vector indicating no privileges; the product's rare deployment footprint further limits real-world risk. This is a classic high-nominal/low-real-risk finding with limited confidentiality, integrity, and availability impact.

RemediationAI

No vendor-released patch has been identified at the time of analysis. As a compensating control, restrict access to the /reviewer_0/admins/ directory to trusted administrators only, ensuring that strong authentication is enforced; this reduces the attack surface but may hinder legitimate administrative workflows. Additionally, implement input validation and parameterized queries in exam-delete.php to neutralize the SQL injection, though this requires custom code changes since the vendor has not provided an update. Consider deploying a web application firewall (WAF) to block malicious test_id parameters, but note that WAF rules can be bypassed with encoding tricks and require ongoing tuning. Given the product's demo/student nature and rare deployment, the most robust remediation is to remove the application from production environments or isolate it from untrusted networks. Monitor the vendor's website (https://www.sourcecodester.com/) and VulDB for any forthcoming patches.

Affected VersionsENISA

Online Reviewer Management System 1.0

Affected Packages

euvd online_reviewer_management_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a SQL injection (CWE-89) in the PHP-based Online Reviewer Management System, specifically in the exam-delete.php script where the test_id parameter is passed to a SQL query without proper sanitization. The application likely uses MySQL as its backend database, and the affected endpoint resides within the administrative directory (/reviewer_0/admins/), meaning that in a properly configured deployment, an attacker would need a valid admin session to reach it. The CPE cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:* indicates that all versions of the product are potentially affected, though only version 1.0 has been confirmed. The CVSS 4.0 vector shows a network-accessible attack with low complexity and no privileges required, but our independent assessment downgrades the privilege requirement to low (PR:L) due to the administrative context.

Know when Online Reviewer Management System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

vuln.today AI 6.3 MEDIUM

SQLi is remote and low-complexity, but the endpoint sits in an /admins/ path so I assess PR:L rather than PR:N; impacts kept partial matching the delete-context scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Sep 23, 2026 - 02:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Sep 23, 2026 - 01:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument test_id leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

Threat Intelligence Overview

EPSS Score

0.4%

Top 63% exploitable

Prevalence

Rare

SourceCodester free student/demo PHP app, negligible production deployment

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.