CVE-2026-36233

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that attackers can inject malicious code via the parameter "subjcode" and use it directly in SQL queries without the need for appropriate cleaning or validation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_assignInstructorSubjects.php_sql_injection.pdfExploit, Mitigation, Third Party Advisory

Timeline

Published: Apr 10, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-362349.8itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename' parameter.CVE-2026-362359.8A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason fo CVE-2026-362369.8SourceCodester Engineers Online Portal v1.0 is vulnerable to SQL Injection in update_password.php via the new_password parameter.CVE-2026-362394.3PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality CVE-2026-36265.3IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret CVE-2026-36279.1IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could a CVE-2026-36285.3IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.CVE-2026-36298.1The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1 CVE-2026-36309.8Delta Electronics COMMGR2 has Stack-based Buffer Overflow vulnerability.CVE-2026-36317.5Delta Electronics COMMGR2 has Buffer Over-read DoS vulnerability.CVE-2026-36325.5A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not pro CVE-2026-363246.1SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in