SourceCodester: Batch of 15 Vulnerabilities Includes High-Severity SQLi and Public Exploits
A batch of fifteen vulnerabilities, including multiple high-severity SQL injection flaws and publicly exploitable issues, were disclosed for SourceCodester products from October 5-6, 2026.
Key findings
- Fifteen vulnerabilities disclosed across SourceCodester products between October 5-6, 2026.
- Multiple high-severity SQL injection flaws identified in systems like Drug Recommendation and Online Reviewer Management.
- Cross-site scripting (XSS) and CSRF vulnerabilities also present in multiple applications.
- Several CVEs have publicly available exploits, increasing immediate risk to users.
- Affected products include version 1.0 of Performance Indicator, Simple Student Information, Drug Recommendation, and Online Reviewer Management systems.
On October 5-6, 2026, a batch of fifteen vulnerabilities was disclosed across multiple SourceCodester products, with a significant cluster of high-severity SQL injection flaws. The disclosures, spanning two days, highlight ongoing security weaknesses in the company's educational and administrative software. The vulnerabilities affect products such as the Performance Indicator System, Simple Student Information System, Drug Recommendation System, and Online Reviewer Management System.
Several SQL injection vulnerabilities were identified, allowing remote attackers to manipulate database queries. Notably, CVE-2026-105957 in the Performance Indicator System, CVE-2026-105807 in the Simple Student Information System, and CVE-2026-105247, CVE-2026-105246, CVE-2026-105182 in the Online Reviewer Management System all carry a High severity rating (CVSSv3 7.3). Additionally, multiple SQL injection flaws were found in the Drug Recommendation System, including CVE-2026-105178 and CVE-2026-105177, both rated Medium (CVSSv3 4.7).
Cross-site scripting (XSS) vulnerabilities were also present. CVE-2026-105809 and CVE-2026-105808 in the Simple Student Information System, and CVE-2026-105705 in the Drug Recommendation System, allow for remote execution of malicious scripts. A cross-site request forgery (CSRF) vulnerability, CVE-2026-105706, was also disclosed in the Drug Recommendation System.
Further complicating the security landscape, CVE-2026-105704 in the Drug Recommendation System, rated High (CVSSv3 7.3), involves improper authentication due to manipulation of the user ID. Another vulnerability, CVE-2026-105179 in the Drug Recommendation System, rated Low (CVSSv3 2.7), involves missing encryption of sensitive data.
The batch includes several vulnerabilities with publicly available exploits, increasing the immediate risk to users. Specifically, CVE-2026-105957, CVE-2026-105808, CVE-2026-105705, CVE-2026-105704, CVE-2026-105247, CVE-2026-105246, CVE-2026-105175, and CVE-2026-105176 have publicly disclosed exploits. This widespread disclosure of exploitable flaws underscores the urgency for users to update their SourceCodester applications.
The affected products are primarily version 1.0, including the Performance Indicator System, Simple Student Information System, Drug Recommendation System, and Online Reviewer Management System. Specific file paths and functions are mentioned in the individual CVE descriptions, indicating potential areas for targeted attacks. Users are strongly advised to consult vendor advisories and apply any available patches or updates to mitigate these risks.
This coordinated disclosure of numerous vulnerabilities, many with public exploits, presents a significant risk to organizations relying on SourceCodester's products for critical operations. The prevalence of SQL injection and XSS flaws suggests a need for more robust input validation and secure coding practices within the affected applications. Users should prioritize patching and consider enhanced security monitoring to detect potential exploitation attempts.