CVE Intelligence
Analysis AI-assisted

CVE-2026-2087: SQL Injection in Online Class Record System 1.0 Admin Login

CVE-2026-2087 describes an SQL injection flaw in the /admin/login.php page of Online Class Record System 1.0, triggered through the user_email parameter and reachable remotely according to the record. NVD lists a CVSS 3.1 base score of 9.8, and the description states that a public exploit has been published. The CISA KEV catalog does not list this CVE, and the record contains no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an SQL injection flaw in the admin login page (/admin/login.php) of the Online Class Record System 1.0. The vulnerable input is the user_email parameter, and the description states the attack may be started remotely.

Impact

  • An SQL injection flaw in a login form can allow an attacker to read or change database content handled by that login logic, depending on how the application builds its queries (inference).
  • NVD lists a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact.
  • The CNA, VulDB, also provides scores in the record: 5.5 under CVSS 4.0, 7.3 under CVSS 3.1 and 7.5 under CVSS 2.0.

Affected products and versions

  • The record lists the affected product as Janobe Online Class Record System, version 1.0, while the description names SourceCodester Online Class Record System 1.0. The sources consulted do not resolve this naming difference.
  • No fixed version is listed. This does not confirm that no fix exists.

Exploitation status

The CVE is not listed in the CISA KEV catalog in this record. The description states that an exploit has been published and may be used. No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • Check whether your environment runs this application and, if so, restrict access to administrative login pages to trusted networks only.
  • Monitor the vendor and project pages for a fix, since none is listed in the record.
  • Apply standard defenses against SQL injection: parameterized queries, strict input validation and a database account with minimal privileges.
  • Treat a web application firewall as a temporary compensating control only, recognizing its limits.

Detection guidance

  • Review web server logs for unusual or malformed values in the user_email parameter on requests to the admin login path.
  • Watch for unexpected database errors or authentication anomalies on the login endpoint.

Limitations of the available information

  • The VulDB entry carries a Permissions Required tag, which conflicts with the record's PR:N metric. The privilege requirement is therefore unknown.
  • The GitHub reference is marked as a broken link.
  • The record provides no fixed version, no vendor advisory and no KEV data.

Frequently asked questions

Is CVE-2026-2087 known to be exploited in the wild?

The CVE is not listed in the CISA KEV catalog in this record, and no confirmed active exploitation appears in the sources consulted. The description states that a published exploit exists and may be used.

Which parameter is affected?

The description identifies the user_email argument on the /admin/login.php page as the vulnerable input.

Is there a fixed version?

The record lists no fixed version. That does not confirm a fix is unavailable, so check the vendor or project for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.