Is CVE-2026-111872 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111872 being exploited in the wild.

How severe is CVE-2026-111872?

High severity, with a CVSS score of 7.3, published 18 October 2026.

Which products and versions are affected?

Itsmeravitejak Online-Examination-System up to commit e6208e630b14657999bbfe4c9912302d2a1e2449.

Is there a fix for CVE-2026-111872?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111872 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111872?

Check whether you run Itsmeravitejak Online-Examination-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111872: itsmeravitejak Online-Examination-System SQL injection in results.php

CVE-2026-111872 · Severity: high · CVSS 7.3 · Published 2026-10-18

An online examination platform is vulnerable to SQL injection attacks in its results page, allowing attackers to query or modify the database without authentication. Attackers can extract exam results, student information, and other sensitive data stored in the system. The vulnerability affects multiple database functions and can be exploited remotely through manipulated query parameters.

Technologies: Itsmeravitejak Online-Examination-System. Vendors: Itsmeravitejak.

Quick answers

Is CVE-2026-111872 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111872 being exploited in the wild.
How severe is CVE-2026-111872?: High severity, with a CVSS score of 7.3, published 18 October 2026.
Which products and versions are affected?: Itsmeravitejak Online-Examination-System up to commit e6208e630b14657999bbfe4c9912302d2a1e2449.
Is there a fix for CVE-2026-111872?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111872 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111872?: Check whether you run Itsmeravitejak Online-Examination-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SQL injection vulnerabilities exist in results.php and database.php where unvalidated GET parameters (id, user) and POST parameter (topic) are directly concatenated into SQL queries. The id and user parameters enable boolean-based blind SQL injection, while the topic parameter allows in-band injection to extract arbitrary rows from the exam_res table. No authentication is required to exploit these flaws.

Affected products

itsmeravitejak Online-Examination-System up to commit e6208e630b14657999bbfe4c9912302d2a1e2449

Timeline

2026-09-25: disclosed: Issue #6 opened on GitHub with SQL injection details
2026-10-18: advisory: CVE-2026-111872 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.