Vulnerability · Published Jan 30, 2026 · Assigned by VulnCheck
CVE-2020-37057Online-Exam-System 2015 - 'fid' SQL Injection
High 8.2
In plain English
A high-severity SQL injection in Online-Exam-System from sunnygkp10. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 53.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' parameter. Attackers can inject malicious SQL code into the 'fid' parameter to potentially extract, modify, or delete database information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sunnygkp10 | Online-Exam-System | 2015 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-48529 exploit
- Software Repository product
- VulnCheck Advisory: Online-Exam-System 2015 - 'fid' SQL Injection third-party-advisory