CVE-2026-2196: Online Reviewer System 1.0 SQL Injection via test_id
CVE-2026-2196 is a SQL injection weakness (CWE-89) in code-projects Online Reviewer System 1.0, located in exam-update.php and triggered through the test_id argument. NVD rates it 9.8 (critical) under CVSS 3.1, and the record states that an exploit has been made public. The sources consulted show no fixed version and no KEV listing.
Overview
CVE-2026-2196 is a SQL injection weakness (CWE-89) reported in code-projects Online Reviewer System 1.0. According to the record, the issue involves the file /system/system/admins/assessments/pretest/exam-update.php and its test_id argument. The record was published on 2026-02-09 and its status is Analyzed, per the NVD entry.
Impact
- NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack, low complexity, no privileges, no user interaction and high impact on confidentiality, integrity and availability.
- As an inference from the SQL injection class, a successful attacker could potentially read, alter or disrupt database content handled by the application. The exact effect in this product is unknown.
Affected products and versions
- The record lists version 1.0 as affected.
- The affected entry names the product 'Fabian Online Reviewer System', while the description names 'code-projects Online Reviewer System 1.0'. The vendor and product identity should be confirmed against the VulDB entry and the vendor page.
- No fixed version is listed in the record. This does not confirm that no fix exists.
Exploitation status
- The description states that the exploit has been made public and could be used. A GitHub issue tagged as an exploit reference is listed in the GitHub issue.
- The record shows no KEV listing. No confirmed active exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Identify whether the application is deployed and whether version 1.0 is in use.
- Restrict access to administrative paths and reduce network exposure of the application until the maintainers publish a fix or verified update.
- As a defensive development measure, apply strict input validation and parameterized queries in the affected code path.
- Check the code-projects website and the CVE Record for updates.
Detection guidance
- Review web server and application logs for unusual requests to the affected file, especially those with abnormal values in the test_id parameter.
- Monitor database error messages and unexpected query behavior originating from the application.
Limitations of the available information
- The record does not provide a fixed version, vendor advisory or patch.
- The product name differs between the affected entry and the description.
- Several CVSS scores from different providers exist: CNA 4.0 score 5.5, CNA 3.1 score 7.3, CNA 2.0 score 7.5 and NVD 3.1 score 9.8. The NVD score is used as the primary reference here.
- One VulDB reference is tagged 'Permissions Required', which conflicts with the PR:N value in the NVD vector and should be verified.
- EPSS data is dated 2026-10-13, which is later than the publication date; its meaning should be verified with the source.
Frequently asked questions
What is CVE-2026-2196?
It is a SQL injection weakness (CWE-89) in code-projects Online Reviewer System 1.0, triggered through the test_id argument of exam-update.php, according to the record.
Is there a fix for this vulnerability?
The record does not list a fixed version. This does not confirm that no fix exists, so check the vendor, the CVE Record and the VulDB entry for updates.
Is this vulnerability being actively exploited?
The record shows no KEV listing, and no confirmed active exploitation in the wild appears in the sources consulted. The description states that an exploit has been made public.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.