Is there a public PoC exploit available for CVE-2026-10111?

Yes, a public proof-of-concept exploit is available for CVE-2026-10111. Prioritise patching immediately. EPSS: 0.0%.

Student Management System CVE-2026-10111

Q: What is the CVSS score of CVE-2026-10111?

CVE-2026-10111 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33450 MEDIUM

SQL Injection (CWE-89)

2026-05-30 VulDB

GHSA-68fj-8vvr-wgf6

SQLi Student Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 30, 2026 - 08:26 vuln.today

Severity Changed

May 30, 2026 - 08:22 NVD

HIGH MEDIUM

CVSS changed

May 30, 2026 - 08:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A flaw has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. This impacts an unknown function of the component Login Page. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in sambitraj's Student Management System 1.0 exposes the login page to unauthenticated remote exploitation via a crafted email parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special conditions are required for exploitation. A public proof-of-concept exploit exists via a published GitHub issue, and the vendor has not responded to responsible disclosure - no patch is available at time of analysis.

Technical ContextAI

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in a SQL Command), indicating the login form constructs a SQL query by directly concatenating or interpolating the user-supplied email input without parameterized queries or prepared statements. The affected product is identified by CPE cpe:2.3:a:sambitraj:student-management-system:*:*:*:*:*:*:*:*, where the version wildcard suggests all releases may be affected, though version 1.0 is explicitly named in the disclosure. The login page component is the attack surface, a common target for authentication bypass via classic SQL injection payloads such as tautology-based expressions. The exploit was published via GitHub issue #2 on the project repository.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor has not responded to the responsible disclosure. If direct code access is available, the primary remediation is to replace all dynamic SQL query construction with parameterized queries or prepared statements in the login page handler, which eliminates the injection vector entirely. As a compensating control, restrict access to the application to trusted network segments or VPN only, preventing unauthenticated internet-facing exposure - this directly limits the AV:N attack vector. Deploying a Web Application Firewall (WAF) with SQL injection signature rules can detect and block common payloads but should not be treated as a substitute for code-level fixes, as sophisticated payloads may bypass signature matching. Disabling the application entirely until a fix is applied is the most conservative option for high-sensitivity deployments. No official advisory URL exists; monitor https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues for any future vendor response.