CVE-2026-36235

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'subjcode' parameter is directly embedded into the SQL query via string interpolation without any sanitization or validation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-362369.8SourceCodester Engineers Online Portal v1.0 is vulnerable to SQL Injection in update_password.php via the new_password parameter.CVE-2026-362394.3PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality CVE-2026-36265.3IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret CVE-2026-36279.1IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could a CVE-2026-36285.3IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.CVE-2026-36298.1The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1 CVE-2026-36309.8Delta Electronics COMMGR2 has Stack-based Buffer Overflow vulnerability.CVE-2026-36317.5Delta Electronics COMMGR2 has Buffer Over-read DoS vulnerability.CVE-2026-36325.5A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not pro CVE-2026-363246.1SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in CVE-2026-36336.5A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbit CVE-2026-36346.5A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (C