CVE-2026-36234 is a SQL injection vulnerability affecting itsourcecode Online Student Enrollment System v1.0, specifically in the newCourse.php file via the coursename parameter. An unauthenticated attacker can remotely exploit this flaw without user interaction to execute arbitrary SQL commands. The vulnerability carries a CVSS score of 9.8 (CRITICAL), reflecting high impacts to confidentiality, integrity, and availability. Exploitation attempts remain minimal with an EPSS score of 0.0004, indicating this vulnerability is not currently prevalent in active exploitation campaigns and does not appear on the CISA Known Exploited Vulnerabilities catalog. This suggests a low immediate threat in the wild, though organizations running this application should prioritize patching due to the critical severity rating and ease of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0CPE matchmatch criteria | cpe:2.3:a:itsourcecode:online_student_enrollment_system:1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.