Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-105254: itsourcecode Online Admission System remote SQL injection via schoolyear.php
CVE-2026-105254 · published 14 days ago
Summary
The web page /admin/schoolyear.php in the itsourcecode Online Admission System does not properly check the data it receives, allowing an attacker to send specially crafted input that tricks the database into running their own commands. This could let someone read, alter, or delete information stored by the system from anywhere on the internet. Apply any available updates from the vendor and ensure that all input fields are validated and escaped before reaching the database.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| itsourcecode | online admission system | 1.0 |
Original advisory text
itsourcecode Online Admission System schoolyear.php sql injection
A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published5 Oct 2026
Updated14 Oct 2026
First seen5 Oct 2026
Track software like this
Free during beta