CVE-2026-95924: SourceCodester Online Reviewer Management System btn_functions.php add sql injection
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=add. The manipulation of the argument difficultyid leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable over the network and requires no privileges or user interaction. An attacker can target the affected endpoint by manipulating the difficulty_id argument in the add action.
Is public exploit information available?
Yes. The exploit has been publicly disclosed, so attackers may be able to use the available information to target exposed installations.
What is the likely impact of successful exploitation?
Successful SQL injection may affect the confidentiality, integrity, and availability of the application, each with low assessed impact in the supplied severity vector.