Online Admission System EUVD-2026-92152

Exploitation targets the specific feature /login1.php and specifically the 'User' login argument, which is not sanitized before being used in a SQL query. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required - exploitation works against a default deployment of itsourcecode Online Admission System 1.0 as long as the login endpoint is network-reachable. The primary limiting factors are the product's rarity (a niche educational PHP application with minimal deployment) and the assessed Low impact scope (VC:L/VI:L/VA:L), indicating partial rather than full database compromise; version is constrained to 1.0.

Signals are mixed and lean toward low-to-moderate real-world risk despite the network-facing, unauthenticated nature of the flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated exploitation with low complexity, which normally elevates urgency, but the vendor-assigned score is only 6.9 (Medium) because all three impact metrics are rated Low (VC:L/VI:L/VA:L) rather than High - meaning the injection is assessed as yielding partial data exposure/manipulation rather than full database compromise or RCE. The E:P (Proof-of-Concept) exploit maturity and the 'publicly available exploit code exists' status (POC on GitHub) raise the practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active, widespread, or automated exploitation. This CVE originates solely from VulDB with no independent vendor advisory, and itsourcecode projects are small educational/hobby PHP applications, so this is a low-priority issue for most enterprises rather than a high-real-risk vulnerability - exploitation probability (EPSS) is unknown and cannot be used to confirm or refute likelihood.

A remote, unauthenticated attacker sends a crafted value in the 'User' parameter of a POST/GET request to /login1.php, injecting SQL that the application concatenates directly into its authentication query. Because public proof-of-concept exploit code exists (GitHub) and no login credentials are required, the attacker can attempt authentication bypass or extraction of limited database contents. Exploitation is low-complexity and scriptable against any reachable instance of the application.