Is there a public PoC exploit available for CVE-2026-10110?

Yes, a public proof-of-concept exploit is available for CVE-2026-10110. Prioritise patching immediately. EPSS: 0.0%.

Student Details Management System CVE-2026-10110

Q: What is the CVSS score of CVE-2026-10110?

CVE-2026-10110 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33448 MEDIUM

SQL Injection (CWE-89)

2026-05-30 VulDB

GHSA-gv5v-x8h4-8rmj

PHP SQLi Student Details Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 30, 2026 - 07:26 vuln.today

Severity Changed

May 30, 2026 - 07:22 NVD

HIGH MEDIUM

CVSS changed

May 30, 2026 - 07:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was detected in code-projects Student Details Management System 1.0. This affects an unknown function of the file /index.php. Performing a manipulation of the argument roll results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Student Details Management System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized roll parameter in /index.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is exploitable over the network with no privileges or user interaction required, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. Impact is rated as partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), though SQL injection primitives often enable escalation beyond the initial access implied by the base score.

Technical ContextAI

The affected product is a PHP-based student records application (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The root cause is failure to parameterize or sanitize user-supplied input before its concatenation into backend SQL queries - a foundational secure coding failure. The CPE string cpe:2.3:a:code-projects:student_details_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected version range beyond version 1.0 as reported. The vulnerable endpoint is /index.php and the injectable parameter is roll, likely corresponding to a student roll number lookup. PHP applications of this class typically use MySQLi or PDO without prepared statements, making them susceptible to error-based, union-based, or blind SQL injection techniques.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fix version appears in any referenced advisory, and code-projects.org has not published a security bulletin. The primary remediation is to replace dynamic SQL string concatenation in /index.php with parameterized queries using PHP's PDO or MySQLi prepared statements, which eliminates the injection surface entirely. As an immediate compensating control, operators should deploy a Web Application Firewall rule to block SQL metacharacters (single quotes, comment sequences, UNION keywords) in the roll parameter - note this introduces a risk of false positives if roll numbers legitimately contain special characters. Additionally, restrict access to the application to trusted network ranges via firewall or .htaccess rules if public exposure is not required, reducing the attack surface consistent with AV:N in the CVSS vector. Input validation enforcing that roll accepts only numeric or alphanumeric values (appropriate to a student roll number) is a low-risk hardening step that should be applied regardless. Monitor database logs for anomalous query patterns as a detection control until a code-level fix is deployed.