CVE Intelligence
Analysis AI-assisted

CVE-2026-2114: itsourcecode Society Management System - SQL Injection via admin_id

CVE-2026-2114 is a critical SQL injection issue in itsourcecode Society Management System 1.0, reachable remotely through the admin_id argument of /admin/edit_admin.php. NVD assigns a CVSS 3.1 base score of 9.8, while the CNA VulDB lists lower scores under other CVSS versions. The record states that a public exploit exists, but the CVE is not listed in CISA KEV, so no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2114 affects itsourcecode Society Management System 1.0 and is described as an SQL injection caused by the admin_id argument of /admin/edit_admin.php. The record was published on 2026-02-07 and has been analyzed by NVD. The CNA is VulDB.

Impact

An attacker who can send requests to the affected endpoint could potentially influence the database queries behind the application. The NVD base score of 9.8 uses the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network access, no privileges or user interaction, and high impact on confidentiality, integrity and availability. The actual consequences in any given deployment are not described in the record.

Affected products and versions

  • The affected field lists Angeljudesuarez Society Management System, version 1.0.
  • The description names itsourcecode Society Management System 1.0, and the reference list links to itsourcecode.com.
  • No fixed version is listed in the record.

Exploitation status

The record states that the exploit is public and may be used, and it includes a reference tagged as an exploit. CISA KEV does not list this CVE, so the sources consulted do not confirm active exploitation or exploitation in the wild. The EPSS probability reported in the record is 0.00429, with a percentile of 0.35406.

Remediation and mitigation

  • No vendor fix is listed in the sources. Contact the vendor or check the product's official channels for an updated release.
  • Restrict access to administrative paths to trusted networks and accounts until a fix is confirmed.
  • Developers should validate inputs and move database access to parameterized queries in the affected code.
  • If patching is not possible, place the application behind controls that limit and log requests to the administrative interface.

Detection guidance

  • Review web server and application logs for requests to edit_admin.php with unusual admin_id values, and for database errors associated with that endpoint.
  • Monitor for unexpected creation or modification of administrator accounts.
  • Alert on bursts of requests to administrative endpoints from unfamiliar sources.

Limitations of the available information

The record does not identify the vulnerable code lines, the full list of affected builds beyond version 1.0, a fixed version, or a vendor advisory. The product name differs between the description and the affected field. The record assigns CWE-74 (Injection), a broader class than the SQL-injection-specific CWE-89, and does not explain the choice. Scores differ across CVSS versions and providers, including CVSS 2.0, 3.1 and 4.0.

Frequently asked questions

What is the vulnerability in CVE-2026-2114?

It is an SQL injection issue in the admin_id argument of /admin/edit_admin.php in itsourcecode Society Management System 1.0, according to the record.

Is this CVE known to be actively exploited?

The record says a public exploit exists, but the CVE is not listed in CISA KEV. The sources consulted do not confirm active exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.