CVE-2020-37051

8.8 highEPSS 0.4%

High (8.8) in sunnygkp10 online-exam-system-. EPSS 0.4% chance of exploitation in the next 30 days.

Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes. Attackers can exploit the 'feed.php' endpoint by crafting malicious payload requests that use time delays to systematically enumerate user password characters.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-01-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sunnygkp10:online-exam-system-

References

https://github.com/sunnygkp10/Online-Exam-System-.git
https://www.exploit-db.com/exploits/48560
https://www.vulncheck.com/advisories/online-exam-system-feedback-sql-injection

Check your stack JSON