VulnSocial

CVE-2026-109620

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-74CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-26: 110-26
Referenced assets1 URL
By indicator
Full discourse1 post
  • Abhinav Singwal@yogsec

    CVE-2026-109620 Third PHP2Shell flaw? No confirmed CVE-2026-109620 exists in current advisories. PHP2Shell comprises only CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state), both CVSS 9.2. Patched in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Active exploitation confirmed within 19 minutes of patch release. No workaround; update immediately. https://nvd.nist.gov/vuln/detail/CVE-2026-109618 #CVE #PHP #php2shell #RemoteCodeExecution

    0000152
    630 followersView on X

Explore more

Back to dashboard