A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topicid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-111873 is a SQL Injection vulnerability in the itsmeravitejak Online-Examination-System affecting the MySQLDB::topicslist function in the exammanger.php file's AJAX Endpoint. The vulnerability allows remote attackers to manipulate the 'subject' argument to execute SQL injection attacks. The product uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early to the project, but no response or fix has been provided yet. The CVSS 4.0 score is 6.9, indicating medium severity.
CVE-2026-111872 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting multiple database-related functions in results.php/include/database.php. The vulnerability arises from manipulation of the id, user, or topic arguments, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so specific affected versions are not clearly identified. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed, but no patch or vendor response is currently available.
CVE-2026-111871 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting an unknown function in the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. The vulnerability arises from manipulation of the query, qtype, sortname, or sortorder parameters, allowing remote attackers to execute SQL injection attacks. The product does not use versioning, so specific affected versions are not available. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). The issue was reported to the project early, but no response or patch has been provided yet. Exploit code is publicly available, but there are no known active exploits in the wild at this time.
CVE-2026-111870 is a security vulnerability in the itsmeravitejak Online-Examination-System affecting the isAdmin function in admin/admin.php. The flaw allows missing authentication due to manipulation, enabling remote attackers to potentially bypass admin authentication. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are identified. The vendor has been informed but has not yet responded or issued a fix. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity).
CVE-2026-110696 is an information disclosure vulnerability in the itsmeravitejak Online-Examination-System affecting an unknown function in the dbtables.sql file. The vulnerability can be exploited remotely without authentication and has a medium severity score of 6.9. The product uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-108970 is a medium severity SQL injection vulnerability in the itsmeravitejak Online-Examination-System. It affects the function MySQLDB::addNewUser in include/database.php within the Registration Form component. The vulnerability allows remote attackers to manipulate the 'branch' argument to perform SQL injection. The product uses a rolling release strategy, so specific affected versions are not provided. The issue was reported early but remains unpatched, and exploit code is publicly available.
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.