CVE-2026-102908

HighCVSS 7.3/10Last modified Sep 30, 2026

Description

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1029097.3A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewe CVE-2026-102914.3A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of CVE-2026-1029107.3A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of CVE-2026-1029119.9A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_ca CVE-2026-1029124.7A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file CVE-2026-1029137.3A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file CVE-2026-1029146.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-CVE-2026-1029158.5Subscriber Broken Access Control in WPO365 <= 44.1 versions.CVE-2026-1029166.8A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS CVE-2026-1029177.8IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerabil CVE-2026-102928.8A vulnerability was detected in UTT HiPER 1200GW up to 2.5.3-170306. This affects the function strcpy of the file /goform/formTaskEdit. The CVE-2026-1029235.4SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService