Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

itsmeravitejak Online-Examination System may let attackers alter data

CVE-2026-111992 · published today
Summary

The exam start feature in the itsmeravitejak Online-Examination System can be tricked by sending a specially crafted topic identifier, allowing an attacker to change or view information stored in the system's database. This can be done from anywhere on the internet and the method is already publicly known. Apply any available updates, restrict who can start exams, and ensure all input is checked for safety.

Original advisory text
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the ...
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topicid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.1 Low
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-111992 · NVD
Track software like this
Free during beta