The vulnerability CVE-2026-5534 affects itsourcecode Online Enrollment System 1.0. It arises from improper handling of the USERID parameter in the /sms/user/index.php?view=edit&id=10 endpoint, enabling remote attackers to inject SQL commands. This can lead to unauthorized database queries or modifications. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed by the vendor, and the exploit code is publicly available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or parameterized queries as a temporary mitigation if possible. Monitor vendor channels for updates and apply patches promptly once released.