Description
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-18
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: SQL injection could allow unauthorized data access and modification
Action: Implement Mitigation
AI Analysis

Impact

A flaw in an undocumented function within subjectsdb.php of itsmeravitejak Online‑Examination‑System enables an attacker to inject arbitrary SQL through the query parameters query, qtype, sortname, and sortorder. Successful manipulation can read, alter, or delete data stored by the application. The injection is executed via standard HTTP requests, making it a remote attack vector, and an exploit has already been publicly released.

Affected Systems

Any instance of the Online‑Examination‑System distributed by itsmeravitejak is affected, including all releases up to the commit e6208e630b14657999bbfe4c9912302d2a1e2449. Because the project does not use semantic versioning, precise unaffected versions cannot be listed.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. EPSS data is currently unavailable and the vulnerability is not listed in CISA’s KEV catalog, yet the presence of a public exploit and the remote nature of the attack suggest a realistic likelihood of exploitation against exposed installations.

Generated by OpenCVE AI on October 18, 2026 at 05:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Identify whether the Online‑Examination‑System is deployed and determine its exposure to the internet
  • Restrict unauthenticated or public access by applying firewall rules, VPNs, or network segmentation to isolate the application
  • Until an official patch is released, modify the affected code to validate input and use parameterized queries for the vulnerable function
  • Monitor application logs for suspicious SQL activity and report any findings to the project maintainers

Generated by OpenCVE AI on October 18, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Title itsmeravitejak Online-Examination-System subjectsdb.php sql injection
First Time appeared Itsmeravitejak
Itsmeravitejak online-examination-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsmeravitejak:online-examination-system:*:*:*:*:*:*:*:*
Vendors & Products Itsmeravitejak
Itsmeravitejak online-examination-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsmeravitejak Online-examination-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-18T03:45:17.829Z

Reserved: 2026-10-17T09:35:01.957Z

Link: CVE-2026-111871

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T04:16:35.227

Modified: 2026-10-18T04:16:35.227

Link: CVE-2026-111871

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T06:00:08Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')