CVE-2026-105246

validated

GHSA-xfr4-jrfv-3c4p ↗EUVD-2026-92266 ↗

check availablenot proven exploitable

cve.orgpublic pockev

sourcecodester Online Reviewer Management System 1.0

ETK-2026-646, permanent identifier

cvss7.3cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

+5h41mTTV

21mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0hcheck available+5h41magent stopped

+2h

+4h

+6h

description

SourceCodester Online Reviewer Management System 1.0 is affected by SQL injection in handling of the Subject input for an assessment-subject update action. A remote attacker may manipulate database queries if the vulnerable update endpoint is reachable.

mitigation

Restrict the assessment-subject update endpoint to trusted administrators and networks immediately. Update the Subject handling to use parameterized database queries, and apply a vendor-fixed release when one is available.

check

available

exploit

automation

deterministic

auth required

EPSS

0.27%17th percentile

agent run time

21m

cve.org record, t = 0

2026-10-05 06:45Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-05 06:45Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-xfr4-jrfv-3c4p
2026-10-05 06:45Z
cve.org record for CVE-2026-105246
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-105246

this entry in the feed

GET /api/v1/feed/CVE-2026-105246

{
  "etk_id": "ETK-2026-646",
  "cve_id": "CVE-2026-105246",
  "display_id": "CVE-2026-105246",
  "ghsa_id": "GHSA-xfr4-jrfv-3c4p",
  "euvd_id": "EUVD-2026-92266",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Online Reviewer Management System",
  "summary": "SourceCodester Online Reviewer Management System 1.0 is affected by SQL injection in handling of the Subject input for an assessment-subject update action. A remote attacker may manipulate database queries if the vulnerable update endpoint is reachable.",
  "mitigation": "Restrict the assessment-subject update endpoint to trusted administrators and networks immediately. Update the Subject handling to use parameterized database queries, and apply a vendor-fixed release when one is available.",
  "vendor": "sourcecodester",
  "product": "Online Reviewer Management System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Online Reviewer Management System",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": 0.0027,
  "epss_percentile": 0.1786,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.541301816666667,
  "t0_at": "2026-10-05T06:45:07.652000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-05T12:25:57.831424+00:00",
      "days": 0.23669189148148148,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T06:45:07.652000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-05T06:45:07.652000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T06:45:07.652000+00:00",
      "url": "https://github.com/advisories/GHSA-xfr4-jrfv-3c4p"
    }
  }
}

published 2026-10-05 12:05Z
last change 2026-10-21 07:05Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.