The vulnerability CVE-2026-9528 affects itsourcecode Electronic Judging System 1.0. It is caused by improper sanitization of the judge_id argument in /admin/delete_judge.php, leading to SQL injection. This allows an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. The vulnerability is publicly documented and exploitable remotely. No official patch or remediation guidance has been provided by the vendor as of the published date.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion. However, the impact is rated medium due to limited details on the extent of data exposure or control. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected /admin/delete_judge.php endpoint to trusted users only and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the judge_id parameter.