CVE-2026-36234 is a critical SQL Injection vulnerability affecting itsourcecode Online Student Enrollment System v1.0. The flaw exists in the 'coursename' parameter of the newCourse.php script, which does not properly sanitize user input before incorporating it into SQL queries. This allows remote attackers to execute arbitrary SQL commands without authentication, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No patch or remediation level has been published by the vendor, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries to mitigate SQL Injection risks in the affected parameter. Monitor vendor channels for updates and apply patches promptly once released.