CVE-2026-36232
A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'classId' parameter from $_GET['classId'] is directly concatenated into the SQL query without any sanitization or validation.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - cve@mitre.org
- Published
- 2026-04-10
- Last modified
- 2026-04-14
- Weaknesses
- CWE-89
Affected products
References
- https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_instructorClasses.php_sql…
