CVE-2026-111873

{
  "etk_id": "ETK-2026-1943",
  "cve_id": "CVE-2026-111873",
  "display_id": "CVE-2026-111873",
  "ghsa_id": "GHSA-7q5v-v72h-cwh3",
  "euvd_id": "EUVD-2026-103384",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Online-Examination-System AJAX endpoint",
  "summary": "Online-Examination-System revisions through commit e6208e630b14657999bbfe4c9912302d2a1e2449 are affected in an AJAX topic-listing operation. A remote, unauthenticated attacker can alter database query behavior when the endpoint is reachable.",
  "mitigation": "Restrict or remove public access to the affected AJAX endpoint until an upstream correction is available, and apply request filtering at the reverse proxy or WAF where feasible. Review newer upstream commits before deployment to confirm that they address the issue.",
  "vendor": "itsmeravitejak",
  "product": "Online-Examination-System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "e6208e630b14657999bbfe4c9912302d2a1e2449"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Online-Examination-System",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": 0.0026,
  "epss_percentile": 0.1715,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.676125116666666,
  "t0_at": "2026-10-18T04:15:14.564000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-18T04:15:14.564000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T04:15:14.564000+00:00",
      "url": "https://github.com/advisories/GHSA-7q5v-v72h-cwh3"
    }
  }
}