A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

A SQL injection vulnerability has been identified in SourceCodester Online Faculty Clearance System version 1.0. The vulnerability exists in the file /update_requirement_status.php, where manipulation of the 'haydi' argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a web-based faculty clearance management system. Attackers could potentially access, modify, or delete database contents through this vulnerability. The issue has been assigned CVE-2026-90877 and reported via GitHub and VulDB.