CVE-2026-36235: SQL Injection
A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'subjcode' parameter is directly embedded into the SQL query via string interpolation without any sanitization or validation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36235?
CVE-2026-36235 is considered a critical severity vulnerability due to the potential for unauthorized database access through SQL injection.
How do I fix CVE-2026-36235?
To fix CVE-2026-36235, sanitize and validate the 'subjcode' parameter before using it in the SQL query to prevent SQL injection.
Which software is affected by CVE-2026-36235?
CVE-2026-36235 affects version 1.0 of the itsourcecode Online Student Enrollment System.
What type of vulnerability is CVE-2026-36235?
CVE-2026-36235 is a SQL injection vulnerability that allows attackers to manipulate the database via unsanitized input.
What file is associated with CVE-2026-36235?
CVE-2026-36235 is associated with the scheduleSubList.php file in the itsourcecode Online Student Enrollment System.