# CVE-2026-15672: itsourcecode Electronic Judging System SQL injection in add_judges.php

Source: https://junglewise.ai/threats/cve-2026-15672-itsourcecode-electronic-judging-system-sql-injection-in-add  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-15672 · Severity: medium · CVSS 6.3 · Published 2026-07-14

itsourcecode Electronic Judging System, a platform used for managing and scoring competitions, contains a security vulnerability in its administrative interface. An attacker can exploit this flaw to execute unauthorized database commands, potentially leading to the theft of sensitive competition data or the modification of judging results. This could undermine the integrity of the judging process and result in unauthorized access to the underlying server information.

Technologies: [Itsourcecode Electronic Judging System](https://junglewise.ai/threats/technologies/electronic-judging-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-15672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15672 being exploited in the wild.

**How severe is CVE-2026-15672?** Medium severity, with a CVSS score of 6.3, published 14 July 2026.

**Which products and versions are affected?** Itsourcecode Electronic Judging System 1.0.

**Is there a fix for CVE-2026-15672?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15672 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15672?** Check whether you run Itsourcecode Electronic Judging System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in itsourcecode Electronic Judging System 1.0 within the '/intrams/admin/add_judges.php' file. The root cause is the failure to properly sanitize or validate the 'fname' parameter before using it in a SQL query. A remote attacker with low privileges (or potentially no authorization, as per conflicting reports) can provide a malicious payload to manipulate database queries. Successful exploitation allows for unauthorized database access, sensitive data leakage, and potential data tampering. A public proof-of-concept utilizing a time-based blind SQL injection (SLEEP) has been disclosed.

## Affected products

- itsourcecode Electronic Judging System 1.0

## Timeline

- 2026-06-15: disclosed: Initial disclosure on GitHub issues
- 2026-07-14: advisory: NVD publication date

## References

- [https://github.com/sjmycz/cve/issues/1](https://github.com/sjmycz/cve/issues/1)
- [https://itsourcecode.com/](https://itsourcecode.com/)
- [https://vuldb.com/cve/CVE-2026-15672](https://vuldb.com/cve/CVE-2026-15672)
- [https://vuldb.com/submit/855930](https://vuldb.com/submit/855930)
- [https://vuldb.com/vuln/378164](https://vuldb.com/vuln/378164)
- [https://vuldb.com/vuln/378164/cti](https://vuldb.com/vuln/378164/cti)

## Related threats

- [itsourcecode Electronic Judging System SQL injection in delete_judge.php](https://junglewise.ai/threats/cve-2026-9528-itsourcecode-electronic-judging-system-sql-injection-in-delete)
- [itsourcecode Electronic Judging System XSS in judges.php](https://junglewise.ai/threats/cve-2026-9527-itsourcecode-electronic-judging-system-xss-in-judges-php)
- [itsourcecode Electronic Judging System SQL injection in edit_team.php](https://junglewise.ai/threats/cve-2026-9526-itsourcecode-electronic-judging-system-sql-injection-in-edit-team)
- [itsourcecode Electronic Judging System SQL injection in edit_judge.php](https://junglewise.ai/threats/cve-2026-9525-itsourcecode-electronic-judging-system-sql-injection-in-edit-judge)
- [itsourcecode Electronic Judging System SQL injection in login.php](https://junglewise.ai/threats/cve-2026-9383-itsourcecode-electronic-judging-system-sql-injection-in-login-php)