CVE-2026-108948

5.4Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-913, CWE-915

Impact

Authenticated remote users can manipulate user profile attributes to alter data or disrupt availability. Attackers need valid low-privileged account credentials to send the malicious request.

Root cause

The application blindly accepts and assigns the user-supplied 'usertype_id' parameter, allowing arbitrary modification of object attributes.

Affected systems

code-projects Online Reviewer System 1.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

No official patched release is available; restrict or block HTTP requests to /reviewer/system/system/admins/manage/users/btn_functions.php, or edit the PHP script to sanitize and restrict the 'usertype_id' field.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108948