CVE-2026-108948 | code-projects Online Reviewer System 1.0 User Profile Update btn_functions.php usertype_id dynamically-determined object attributes

October 11, 2026 Yanac

A vulnerability was found in code-projects Online Reviewer System 1.0. It has been classified as problematic. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes.

This vulnerability is documented as CVE-2026-108948. The attack can be initiated remotely. Additionally, an exploit exists.VulDB Recent EntriesRead More