The vulnerability CVE-2026-4842 affects itsourcecode Online Enrollment System 1.0. It is an SQL injection issue in the Parameter Handler component, located in the /sms/grades/index.php script, where the 'deptid' parameter is not properly sanitized. This allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the vulnerable component and employing web application firewalls with SQL injection detection rules may help mitigate risk.