EUVD-2026-14713
GHSA-c68m-rr26-fc4q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A flaw has been found in SourceCodester Online Admission System 1.0. This affects an unknown function of the file /programmes.php. Executing a manipulation of the argument program can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
AnalysisAI
SourceCodester Online Admission System 1.0 contains a SQL injection vulnerability in the /programmes.php file's program parameter that allows unauthenticated remote attackers to execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch is currently available. The flaw enables attackers to potentially read, modify, or delete sensitive admission system data.
Technical ContextAI
The vulnerability is classified as CWE-89 (SQL Injection) and affects the SourceCodester Online Admission System 1.0, identified by CPE cpe:2.3:a:sourcecodester:online_admission_system:*:*:*:*:*:*:*:*. The flaw occurs in the /programmes.php file where user-supplied input from the 'program' parameter is insufficiently sanitized before being incorporated into SQL queries. This PHP-based application fails to implement proper input validation or parameterized queries, allowing attackers to inject arbitrary SQL commands that are executed by the backend database. SQL injection vulnerabilities remain among the most critical web application security risks as they can lead to complete database compromise.
RemediationAI
As indicated by the CVSS Remediation Level (RL:X), no official patch or updated version appears to be available from the vendor at this time. Organizations should immediately implement compensatory controls including: deploying a Web Application Firewall (WAF) with SQL injection detection rules specifically targeting the /programmes.php endpoint and the 'program' parameter; implementing input validation and sanitization at the application perimeter to filter malicious SQL metacharacters; restricting database user privileges to minimum necessary permissions to limit potential damage from successful exploitation; and conducting code review to implement parameterized queries or prepared statements in the affected file. Organizations should monitor vendor communications at https://www.sourcecodester.com/ for future security updates. Given the absence of an official patch and the availability of public exploits, consider migrating to alternative admission management systems with active security maintenance if the vendor does not respond promptly. Additional technical details for manual remediation can be referenced from the vulnerability submission at https://vuldb.com/?submit.775788.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today