Cyber Resilience

CVE-2026-2090

Medium

Published: 07 February 2026

Published
07 February 2026
Modified
10 February 2026
KEV Added
—
Patch
—
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0031 22.8th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-2090 is a medium-severity Injection (CWE-74) vulnerability in Janobe Online Class Record System. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-2090 is a SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester Online Class Record System 1.0. The flaw affects the processing of the file /admin/message/search.php, where manipulation of the 'term' argument enables SQL injection attacks.

Unauthenticated remote attackers can exploit this vulnerability with low complexity, as indicated by its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation allows limited impacts on confidentiality, integrity, and availability through arbitrary SQL query execution.

Advisories and further details are documented in references including a GitHub issue at https://github.com/xiaoccm07/cve/issues/3, VulDB entries at https://vuldb.com/?ctiid.344657, https://vuldb.com/?id.344657, and https://vuldb.com/?submit.746551, and the vendor site at https://www.sourcecodester.com/. The exploit has been publicly disclosed and may be utilized.

The vulnerability was published on 2026-02-07T16:15:47.727, with no reported real-world exploitation status in available details.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admin/message/search.php. Executing a manipulation of the argument term can lead to sql injection. The attack can be executed remotely. The…

more

exploit has been publicly disclosed and may be utilized.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct remote unauthenticated exploitation of a public-facing web application via SQL injection in search.php.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-2089Same product: Janobe Online Class Record System
CVE-2026-2087Same product: Janobe Online Class Record System
CVE-2026-36236Same vendor: Janobe
CVE-2025-1192Same vendor: Janobe
CVE-2025-1191Same vendor: Janobe
CVE-2024-48245Same vendor: Janobe
CVE-2026-2116Shared CWE-74, CWE-89
CVE-2025-15436Shared CWE-74, CWE-89
CVE-2026-6148Shared CWE-74, CWE-89
CVE-2026-3792Shared CWE-74, CWE-89

Affected Assets

janobe
online class record system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of untrusted inputs such as the 'term' parameter before they reach SQL queries, blocking the injection vector in search.php.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the known SQL injection flaw in the publicly disclosed SourceCodester code.

SI-4 System Monitoring partial match
detect

Enables detection of anomalous SQL statements or error patterns resulting from attempted exploitation of the term argument.

References