CVE-2026-2690 MEDIUM

CVE-2026-2690: itsourcecode Event Management System Admin Login ajax.php sql injection

Vendor Itsourcecode

Product Event Management System

Weakness CWE-89 · SQLi

Published February 19, 2026

Last update February 24, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Key dates

02Disclosure timeline

February 19, 2026 CVE published

February 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-2690 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html