The vulnerability CVE-2026-9525 affects itsourcecode Electronic Judging System 1.0. It is caused by improper sanitization of the judge_id parameter in the /admin/edit_judge.php script, allowing an unauthenticated remote attacker to perform SQL injection. This can potentially lead to unauthorized database queries or data manipulation. The vulnerability has been publicly disclosed, but no vendor-provided patch or official fix is currently documented. Exploits are not known to be in the wild at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may result in unauthorized data access, modification, or deletion. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to the confidentiality and integrity of the affected system's data. However, the CVSS score and vector indicate limited scope and impact, suggesting some constraints on the exploitability or consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider implementing input validation or parameterized queries as a temporary mitigation. Restricting access to the /admin/edit_judge.php endpoint to trusted users or IP addresses may reduce exposure. Monitor vendor channels for updates or patches addressing this vulnerability.