CVE-2026-36235

A critical SQL injection vulnerability (CVE-2026-36235) has been identified in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0, where the 'subjcode' parameter is directly embedded into SQL queries without sanitization or validation. The vulnerability carries a CVSS score of 9.8 (Critical) with a network-based attack vector requiring no authentication, user interaction, or special privileges, enabling attackers to read, modify, or delete sensitive database contents. Exploitation is not currently documented in active campaigns or public exploit code repositories, and the vulnerability maintains an inactive status on exploit tracking databases, suggesting limited immediate threat activity. However, the straightforward nature of SQL injection attacks means that exploitation tools could be developed and weaponized quickly if this vulnerability receives wider attention or is discovered in production environments.