CVE-2026-93959: SourceCodester Online Reviewer Management System btn_functions.php sql injection

Published Sep 20, 2026

Updated

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer0/admins/assessments/course/btnfunctions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Affected Software

1 affected component

Sourcecodester Online Reviewer Management System=1.0

Event History

Sep 20, 2026

CVE Published

via MITRE·02:30 AM

Data Sourced

via MITRE·02:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is remotely exploitable and requires no privileges or user interaction according to the supplied vector. An attacker able to reach the affected application endpoint could attempt exploitation.

What input is involved in the injection?

The SQL injection is triggered by manipulation of the Course argument handled by /reviewer_0/admins/assessments/course/btn_functions.php. The exact affected processing and parameter format are not specified.

Is public exploit information available?

Yes. The exploit has been publicly disclosed and may be used by attackers.

How serious is the potential impact?

The supplied severity vector rates the issue high at 7.3 and indicates potential low impact to confidentiality, integrity, and availability. The provided information does not identify specific data or actions that could be affected.

CVE-2026-93959: SourceCodester Online Reviewer Management System btn_functions.php sql injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the injection?

Is public exploit information available?

How serious is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the injection?

Is public exploit information available?

How serious is the potential impact?