CVE-2026-95925

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0

Description Remote SQL injection is possible through the manipulation of the difficulty id variable within an unknown function of the '/reviewer 0/admins/assessments/databank/btn functions.php?action=update' endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the difficulty id parameter in the '/reviewer 0/admins/assessments/databank/btn functions.php?action=update' endpoint until the issue is resolved.