A weakness exists in the Online‑Examination‑System’s dbtables.sql – an unknown function within the file can be manipulated, allowing an attacker to retrieve sensitive data. The vulnerability permits information disclosure and may be triggered remotely. No version information is available because the product follows a rolling release model, and a specific fix has not been released.

The affected product is Online‑Examination‑System by itsmeravitejak. Because the project uses a continuous delivery approach, no discrete affected or fixed versions are listed; any current or future releases are potentially vulnerable until the issue is addressed by the maintainer.

The CVSS score of 6.9 reflects a moderate impact. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, so widespread exploitation has not yet been reported. However, the exploit has been made public, meaning that a remote attacker could craft a request that manipulates dbtables.sql and exfiltrates data if system access is allowed. The lack of a patch increases the risk that an unauthenticated attacker could exploit the vulnerability until it is resolved by the vendor.