CVE-2026-2912
Published: 22 February 2026
Summary
CVE-2026-2912 is a medium-severity Injection (CWE-74) vulnerability in Fabian Online Reviewer System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2912 is a SQL injection vulnerability (CWE-74, CWE-89) discovered in code-projects Online Reviewer System 1.0. The issue affects an unknown function within the file /system/system/students/assessments/results/studentresult-view.php, where manipulation of the test_id argument enables the injection. Published on 2026-02-22T04:15:59.590, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), rated as high severity.
Remote attackers can exploit this vulnerability without requiring privileges or user interaction, launching SQL injection attacks over the network with low complexity. Exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption depending on the database backend.
Advisories referenced on VulDB (ctiid.347221, id.347221, submit.755219), a GitHub issue at tiancesec/CVE/issues/25, and code-projects.org provide details on the vulnerability. The exploit has been made public and could be used, underscoring the need for practitioners to review these sources for any patch availability or workaround recommendations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7545
Vulnerability details
A vulnerability was found in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/students/assessments/results/studentresult-view.php. The manipulation of the argument test_id results in sql injection. It is possible to launch the attack remotely. The exploit has…
more
been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated public-facing web app (studentresult-view.php) directly enables remote exploitation of the application per T1190; limited C/I/A impacts do not map to additional techniques such as RCE or specific data staging.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of the test_id parameter in studentresult-view.php to block SQL injection payloads before they reach the database.
Mandates timely remediation of the publicly disclosed SQL injection flaw in the Online Reviewer System code.
Boundary protection devices (e.g., WAF rules) can inspect and block SQL injection attempts targeting the exposed /studentresult-view.php endpoint.