Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-108948: Online Reviewer System lets remote attackers change user profiles
CVE-2026-108948 · published 6 days ago
Summary
The Online Reviewer System version 1.0 contains a flaw in the user profile update code that lets an attacker change how data is handled by sending a crafted usertype_id value. This can be triggered over the network without needing to log in, potentially allowing unauthorized changes to user accounts. Apply the vendor’s patch or update to a secured version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| code-projects | online reviewer system | 1.0 |
Original advisory text
code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published13 Oct 2026
Updated16 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta