CVE-2026-2090: SourceCodester Online Class Record System SQL Injection

Overview

CVE-2026-2090 is an SQL injection issue in SourceCodester Online Class Record System 1.0. According to the description, the flaw is in the processing of the term argument in /admin/message/search.php. The record was published on 2026-02-07 and is marked as analyzed.

Impact

• NVD assigns a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network attack, low complexity, no privileges required and no user interaction.
• The vector reports high impact on confidentiality, integrity and availability. In practice, the effect on a given deployment depends on the database and application configuration, which the record does not describe.
• The CWE mapped in the record is CWE-74 (Injection), while the description specifically says SQL injection.

Affected products and versions

• The description refers to SourceCodester Online Class Record System 1.0.
• The structured affected-product field lists Janobe Online Class Record System with version 1.0. The record does not reconcile these two product names.
• No fixed version is listed in the record.

Exploitation status

• The record shows CISA KEV listed as false. No confirmed active exploitation appears in the sources consulted.
• The description states that the exploit has been publicly disclosed and may be used.
• The EPSS probability is 0.00363 with a percentile of 0.28292 in the record.

Remediation and mitigation

• No vendor fix is identified in the record. The absence of a listed fix does not mean none exists, so check with the vendor or the SourceCodester project.
• Restrict access to administrative paths such as /admin to trusted users, using network controls or an authentication gateway.
• Ask the development team to use parameterized queries and strict server-side input validation for search parameters.
• If the product is in use and no verified fix is available, consider isolating or removing it until remediation is confirmed.

Detection guidance

• Review web server and application logs for unusual requests to /admin/message/search.php, especially those with abnormal or unexpectedly long values in the term parameter.
• Monitor for database error messages returned by the application and for unexpected query behavior.
• Use web application firewall alerts for SQL injection patterns as a supplementary control, not as a replacement for code fixes.

Limitations of the available information

• The product naming conflicts between the description and the affected-product field, and the record does not resolve which product and vendor are correct.
• No fixed version, patch or vendor advisory is listed in the record.
• The CVSS scores from the CNA (VulDB) differ from the NVD score, and the record does not explain the difference.
• The EPSS date in the record is 2026-10-13, which should be verified against the current data feed.
• The vulnerable code path is not described beyond the file name and parameter.

Frequently asked questions

Is this CVE being actively exploited?

The record shows it is not listed in CISA KEV, so no confirmed active exploitation appears in the sources consulted. The description does state that a public exploit has been disclosed.

Is there a fix available?

No fixed version is listed in the record. Check with the vendor or project, and in the meantime restrict access to administrative paths and rely on input validation and parameterized queries.

Which product is affected?

The description names SourceCodester Online Class Record System 1.0, while the affected-product field names Janobe Online Class Record System 1.0. The record does not resolve this mismatch.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.