The vulnerability CVE-2026-9525 affects itsourcecode Electronic Judging System 1.0. It is caused by improper sanitization of the judge_id parameter in the /admin/edit_judge.php script, allowing an unauthenticated remote attacker to inject SQL commands. This can lead to unauthorized database queries or modifications. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No vendor advisory or patch information is available, and the product is not a cloud service.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL queries via the judge_id parameter, potentially leading to unauthorized data access or modification within the Electronic Judging System database. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the /admin/edit_judge.php endpoint to trusted administrators only and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the judge_id parameter.