CVE-2026-36234 identifies a SQL Injection vulnerability in the itsourcecode Online Student Enrollment System v1.0. Specifically, the 'coursename' parameter in the newCourse.php file does not properly sanitize user input, enabling injection of arbitrary SQL commands. This flaw could potentially allow attackers to interfere with the backend database queries executed by the application. The vulnerability was published on April 10, 2026, but no CVSS score or remediation details have been provided. The system is not cloud-hosted, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. However, the exact impact depends on the database privileges and the application's architecture. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation to prevent SQL Injection via the 'coursename' parameter.