CVE-2026-108948
LOW
2,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low
MEDIUM
5,5
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: single
Confidentiality: none
Integrity: partial
Availability: partial
Description
AI Translation Available
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
913
Improper Control of Dynamically-Managed Code Resources
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Other
Potential Impacts:
Execute Unauthorized Code Or Commands
Varies By Context
Alter Execution Logic
Applicable Platforms
Languages:
Not Language-Specific, Interpreted
915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Other
Potential Impacts:
Modify Application Data
Execute Unauthorized Code Or Commands
Varies By Context
Alter Execution Logic
Applicable Platforms
Languages:
Ruby, ASP.NET, PHP, Python, Not Language-Specific
https://code-projects.org/
https://github.com/thuong2206/Online-Reviewer-System-Privilege-Escalation
https://vuldb.com/cve/CVE-2026-108948
https://vuldb.com/submit/997820
https://vuldb.com/vuln/416772
https://vuldb.com/vuln/416772/cti