CVE-2026-2089

Published Feb 7, 2026·Updated Jun 17, 2026

NVD Description

A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Public Exploits & PoCs3 found

[POC] GHSA-3whf-vgf2-9w6g — CVE-2026-20896

Gitea Docker Image Authentication Bypass

[POC] GHSA-8qqm-fp2q-v734 — CVE-2026-20896

this is a modified POC of rz1027 for CVE-2026-20896

[POC] CVE-2026-20896 — CVE-2026-20896

Public PoC and detector for CVE-2026-20896 ("Gitea Docker: One Header, Any User")

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free