CVE-2026-108956: SQL Injection in code-projects Online Reviewer System

The vulnerability CVE-2026-108956 exists in code-projects Online Reviewer System 1.0, specifically in an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php in the User Update Handler component. This flaw allows remote attackers to perform SQL injection attacks by manipulating input to the affected function, potentially leading to unauthorized database access or modification. Public exploit code is available, increasing the risk of exploitation, although no active exploitation has been documented. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL injection vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No known active exploitation in the wild has been reported.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected component and monitor for suspicious activity related to SQL injection attempts.