CVE-2026-36950 identifies a SQL injection vulnerability in Sourcecodester Online Thesis Archiving System v1.0, specifically in the /otas/projects_per_department.php script. This vulnerability could allow an attacker to inject malicious SQL code, potentially leading to unauthorized data access or modification. The vulnerability is publicly known as of April 13, 2026, but no patch or remediation level has been published by the vendor. There are no known exploits reported in the wild at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized disclosure, modification, or deletion of data stored by the application. However, no specific impact details or exploitation reports are currently available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying general SQL injection mitigations such as input validation and parameterized queries if possible. Monitor vendor channels for updates regarding patches or official mitigations.