CVE-2026-108948 MEDIUM

CVE-2026-108948: code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes

Vendor Code-Projects
Product Online Reviewer System
Weakness CWE-915
Published October 13, 2026
Last update October 13, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

October 13, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-6366 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 CVE-2026-48943 Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26 CVE-2025-13081 Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006 CVE-2026-15083 ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074 CVE-2024-55636 Drupal core - Less critical - Gadget chain - SA-CORE-2024-006