CVE-2026-95927: SourceCodester Online Reviewer Management System exam-delete.php sql injection
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument testid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely without privileges or user interaction. It affects the test_id argument handled by the exam-delete.php endpoint.
Is exploit code available?
Yes. A public exploit is available, so organizations operating the affected application should treat exploitation as practical.
What is the potential impact?
The supplied severity vector indicates low impact to confidentiality, integrity, and availability. Because the flaw is SQL injection, successful exploitation may allow an attacker to influence database queries through the test_id parameter.