CVE-2026-36235

PoC —

CVSS 3.1

9.8 critical

EPSS

<1%p25

Published

Apr 10, 2026 (Apr 10, 2026)

Modified

Jun 17, 2026

Description

A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'subjcode' parameter is directly embedded into the SQL query via string interpolation without any sanitization or validation.

Vendors: itsourcecode
Products: online student enrollment system
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.