CVE-2026-3153
Published: 25 February 2026
Summary
CVE-2026-3153 is a medium-severity Injection (CWE-74) vulnerability in Admerc Document Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3153 is a SQL injection vulnerability (CWE-74, CWE-89) in itsourcecode Document Management System 1.0. The flaw impacts an unknown function within the /register.php file, where manipulation of the Username argument enables SQL injection.
Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only low attack complexity, as reflected in its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Exploitation allows limited impacts on confidentiality, integrity, and availability through SQL injection.
Advisories referenced in VulDB entries (ctiid.347661, id.347661, submit.758831) and a GitHub issue document the vulnerability, noting that the exploit has been publicly disclosed and may be used. The vendor site at itsourcecode.com provides context on the affected software, but no patches or specific mitigations are detailed in the available references.
The exploit disclosure heightens the risk for exposed instances of Document Management System 1.0, published on 2026-02-25.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8509
Vulnerability details
A vulnerability has been found in itsourcecode Document Management System 1.0. Impacted is an unknown function of the file /register.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit…
more
has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing /register.php directly enables initial access via exploitation of a public-facing web application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted inputs such as the Username argument in register.php to block SQL injection payloads.
Boundary protection devices (e.g., WAF rules) can inspect and drop remote SQL injection attempts against /register.php before they reach the application.
Least-privilege database accounts limit the impact of any successful injection by restricting the operations an unauthenticated attacker can perform.