CVE-2026-108948— code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
Quick assessment
Affected
code-projects Online Reviewer System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 code-projects Online Reviewer System 1.0 中发现了一个漏洞。该漏洞影响了位于文件 中、与“用户配置文件更新处理程序（User Profile Update Handler）”组件相关的未明确代码。通过对参数 的操作，可影响动态确定的对象属性。此漏洞可由远程发起攻击。该漏洞已被公开披露，并可能被利用。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| code-projects | Online Reviewer System | 1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108948
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| code-projects | Online Reviewer System | 1.0 |
cpe:2.3:a:code-projects:online_reviewer_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-108948
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108948
请登录查看更多情报信息。
Proof of Concept for CVE-2026-108948 (1)
IV. Related Vulnerabilities
Same product: Online Reviewer System
-
CVE-2026-109620
SourceCodester Online Reviewer System index.php prepare sql -
CVE-2026-108956
code-projects Online Reviewer System User Update btn_functio -
CVE-2026-4972
code-projects Online Reviewer System btn_functions.php cross -
CVE-2026-2912
code-projects Online Reviewer System studentresult-view.php -
CVE-2026-2224
code-projects Online Reviewer System btn_functions.php cross
Same vendor: code-projects
-
CVE-2026-108956
code-projects Online Reviewer System User Update btn_functio -
CVE-2026-108938
code-projects Matrimonial System matrimony.sql file access -
CVE-2026-108937
code-projects Online Ticket Reservation System medallion.sql -
CVE-2026-105188
code-projects Human Resource Management System Live Event Hi -
CVE-2026-105173
code-projects Human Resource Management Event Creation Event
Same weakness: CWE-915
-
CVE-2026-92119
Apache Allura: REST API Mass Assignment -
CVE-2026-109186
jshERP through 3.6 Mass Assignment via PUT /user/update -
CVE-2026-108740
GoatCounter through 2.7.0 Privilege Escalation via /user/pre -
CVE-2026-105180
Jeebase UserService info updateUser dynamically-determined o -
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion
V. Comments for CVE-2026-108948
No comments yet