EUVD-2026-101704
GHSA-m4r4-4985-99p5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Online-Examination-System instance
-
ExploitSend crafted request targeting dbtables.sql logic
-
ImpactRetrieve disclosed database information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | A reachable, running deployment of itsmeravitejak's Online-Examination-System is required, after which exploitation is remote and unauthenticated (PR:N, UI:N, AC:L) per the CVSS 4.0 vector. The precise prerequisite feature is not stated by the source - the description only attributes the flaw to 'an unknown function of the file dbtables.sql' and does not name a configuration setting or deployment mode. Limiting factors: impact is confined to low-confidentiality information disclosure (VC:L, no integrity or availability impact), there is no official patch because the project is rolling-release and the maintainer has not responded, and realistic exposure is constrained by the product's near-zero deployment base rather than by any technical access barrier. |
| Impact | This is a low-priority, low-real-risk issue despite its network attack vector. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity access, but the only impact is low confidentiality (VC:L) with no integrity or availability impact, yielding a modest 5.5 base score. The 'E:P' exploit-maturity metric and the description both indicate a public proof-of-concept exists, so the exploitation status is 'publicly available exploit code exists' - this is NOT the same as active exploitation. The CVE is not listed in CISA KEV, and no EPSS probability was provided in the input, so widespread opportunistic exploitation cannot be confirmed from the data. The dominant risk-limiting factor is the target itself: 'Online-Examination-System' is an obscure individual GitHub project (itsmeravitejak) with no enterprise footprint, and the vendor has not responded to the issue report, so no patch exists. The description is also notably thin - 'an unknown function of the file dbtables.sql' does not specify the concrete disclosure mechanism - so the precise data exposed should be verified against the public PoC and vuldb.com/vuln/419855 before treating this as actionable. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker targets an instance of the Online-Examination-System web application and leverages a flaw related to the dbtables.sql database schema file to read information that should not be exposed. A public proof-of-concept is referenced, lowering the effort required, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N the attack needs no credentials, user interaction, or special timing - only network reachability to a vulnerable deployment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Information disclosure in itsmeravitejak's Online-Examination-System allows a remote, unauthenticated attacker to read data exposed through the project's dbtables.sql file, with the assessed impact limited to low-confidentiality leakage (no integrity or availability effect). The project follows a rolling-release model, so no discrete affected or fixed version exists; EUVD records commit e6208e630b14657999bbfe4c9912302d2a1e2449 as the affected snapshot. Publicly available exploit code exists and the upstream maintainer has not responded to the issue report, but there is no confirmed actively exploited (CISA KEV) status, and real-world exposure is constrained by the product's near-zero deployment base rather than by any technical barrier. This is a low-priority, low-real-risk issue despite its network attack vector.
RemediationAI
No vendor-released patch identified at time of analysis: the project is rolling-release and the maintainer has not responded to the upstream issue report (https://github.com/itsmeravitejak/Online-Examination-System/issues/9), so there is no fixed version to cite and deployments must be remediated locally. The most direct control is to stop serving dbtables.sql over HTTP - move the file outside the web document root, or add explicit deny rules for it (for Apache, a <Files "dbtables.sql"> Require all denied block; for nginx, a location ~* \.sql$ { deny all; } rule) - with the trade-off that the installer or any tooling that fetches the schema over HTTP will break and must be updated to use a local path or a one-time authenticated import. Additionally, block public network access to the application's static/data directories via firewall or reverse-proxy ACLs, and if the file has already been exposed, treat any credentials, seeded accounts, or examination data it contains as compromised and rotate them, accepting the operational cost of credential resets. Monitor web logs for requests to dbtables.sql or similar .sql artifacts as a detection signal, and re-check the upstream repository periodically for a later commit that removes or relocates the file. Cross-reference the advisory at https://vuldb.com/vuln/419855 and the EUVD entry EUVD-2026-101704 for any updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is located in the file dbtables.sql, a SQL schema/dump artifact that is part of the Online-Examination-System repository. When such a dump file is reachable through a deployed web instance (for example, left inside the document root rather than executed or denied by the web server), its contents - table definitions and any seeded or default records such as credentials or examination data - can be retrieved without authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N, E:P) describes a network-reachable, low-complexity, unauthenticated path with only low confidentiality impact and no effect on integrity or availability, consistent with our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The reporting source states only that an unknown function of dbtables.sql is involved and does not name a specific configuration or feature, so the exact trigger condition is not confirmed from the available data. No CPE identifiers were supplied, and because the project is continuously delivered on a rolling-release basis, no versioned affected/fixed comparison can be constructed beyond the cited commit hash.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remote unauthenticated low-complexity access (AV:N/AC:L/PR:N/UI:N) with only low confidentiality impact and no integrity or availability effect, matching CWE-200 information disclosure.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is an unknown function of the file dbtables.sql. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB