CVE-2026-105186: SQL Injection in itsourcecode Online Admission System

The vulnerability CVE-2026-105186 affects itsourcecode Online Admission System 1.0. It is caused by improper sanitization of the schedid parameter in the /new.php file, allowing an attacker to perform SQL injection. This can be triggered remotely with low attack complexity and no user interaction. The CVSS 4.0 base score is 5.3 (medium severity), reflecting limited impact and exploitability. An exploit has been published, but no evidence of widespread exploitation is reported. No vendor advisory or patch information is provided.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the low scope and integrity impact metrics, but it still poses a risk to data confidentiality and integrity within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the schedid parameter.