SQL Injection Vulnerability in SourceCodester Engineers Online Portal by SourceCodester
CVE-2026-36236

9.8CRITICAL

Key Information:

Vendor: SourceCodester
Status: Engineers Online Portal
Vendor: CVE Published:; 10 April 2026

🔔 Create SourceCodester Vulnerability Alert

What is CVE-2026-36236?

The Engineers Online Portal v1.0 developed by SourceCodester suffers from a SQL Injection vulnerability in the update_password.php script. An attacker can exploit this weakness via the new_password parameter to execute arbitrary SQL queries, potentially compromising the database and exposing sensitive user information. Proper input validation and parameterized queries should be implemented to mitigate this risk.

References

https://github.com/Amorsec/CVE-PHP/blob/main/sourcecodest...

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 10, 2026
Vulnerability Reserved
Apr 6, 2026

CVE-2026-36236 Data

JSON