CVE-2026-108948: code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Profile Update Handler. The manipulation of the argument usertypeid leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-level privileges and network access to the affected application. The issue affects the User Profile Update Handler in Online Reviewer System 1.0.
Does exploitation require user interaction or complex conditions?
No user interaction is required. The supplied metrics indicate low attack complexity and remote exploitation over the network.
Is public exploit information available?
Yes. Exploit details have been publicly disclosed and may be used by attackers.