CVE-2026-36233

OVERVIEW: CVE-2026-36233 is a SQL injection vulnerability identified in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0. The flaw allows attackers to inject malicious SQL code through the "subjcode" parameter, which is processed directly in database queries without proper input sanitization or validation. SEVERITY: This vulnerability carries a CVSS v3.1 score of 9.8 CRITICAL, reflecting severe risk potential. The attack vector is network-based with low complexity, requires no privileges or user interaction, and impacts the confidentiality, integrity, and availability of the affected system. The vulnerability poses significant risk for data theft, unauthorized modification, and system disruption. EXPLOITATION STATUS: The vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and appears inactive on exploit hot lists, suggesting limited active exploitation in the wild at present. However, the FAUCET Risk Score of 45.0/100 indicates moderate community concern. The straightforward nature of SQL injection attacks suggests that exploit code could be readily developed or adapted by threat actors.