The vulnerability CVE-2026-104123 affects SourceCodester Online Reviewer Management System 1.0. It is an SQL injection issue caused by improper sanitization of the 'Title' parameter in the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. This allows remote attackers to manipulate SQL queries via the 'Title' argument, potentially compromising the database. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. Public exploit code is available, but no confirmed exploitation in the wild has been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to confidentiality, integrity, and availability to a low degree. Since the attack can be launched remotely without authentication, the vulnerability poses a moderate risk to affected systems.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the vulnerable functionality and implement input validation or web application firewall rules to block malicious SQL injection payloads targeting the 'Title' parameter.