CVE-2026-36236 identifies a critical SQL Injection vulnerability (CWE-89) in SourceCodester Engineers Online Portal v1.0. The flaw exists in the update_password.php file where the new_password parameter is not properly sanitized, allowing remote attackers to inject malicious SQL queries without authentication. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its ease of exploitation and severe impact on confidentiality, integrity, and availability. No patch or vendor remediation information is currently available, and the affected versions are unspecified.

Successful exploitation of this SQL Injection vulnerability can lead to unauthorized data access, data modification, and potentially full system compromise. The attacker can execute arbitrary SQL commands remotely without any privileges or user interaction, severely impacting the confidentiality, integrity, and availability of the application and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries on the new_password parameter to prevent SQL Injection. Monitoring and restricting database permissions may also reduce potential impact.