Which versions of Student Management System are affected by CVE-2026-10226?

The Student Management System (PHP) contains an unauthenticated SQL injection vulnerability affecting user_id, course_id, teacher_id, student_id, and application_id parameters, with publicly…

Is there a public PoC exploit available for CVE-2026-10226?

Yes, a public proof-of-concept exploit is available for CVE-2026-10226. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10226?

Within 24 hours: Identify all deployments and restrict network access to trusted internal networks only at firewall level. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in affected parameters; restrict database user privileges to minimum necessary roles; enable comprehensive query logging. Within 30 days: Vendor shows no active maintenance (rolling release model, no response to notification); evaluate remediation through internal development using parameterized queries and prepared statements, or initiate replacement with actively maintained student management solution.

Student Management System CVE-2026-10226

Q: What is the CVSS score of CVE-2026-10226?

CVE-2026-10226 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33559 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-v885-xchw-jj5c

PHP SQLi Student Management System By Php Raisulislamg4

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 06:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 06:20 vuln.today

DescriptionCVE.org

A flaw has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. Impacted is an unknown function of the file delete.php. Executing a manipulation of the argument user_id/course_id/teacher_id/student_id/application_id can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in raisulislamg4's Student Management System (PHP) allows remote unauthenticated attackers to manipulate database queries via the user_id, course_id, teacher_id, student_id, or application_id parameters in delete.php. Publicly available exploit code exists, and the project operates on a rolling release model with no formal versioning, complicating patch tracking. The maintainer has been notified but has not responded, leaving deployments exposed.

Technical ContextAI

The vulnerable component is delete.php within a PHP-based student management web application that uses unspecified backend SQL storage (likely MySQL given the typical LAMP stack of such projects). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), in which user-supplied parameters are concatenated or interpolated directly into SQL statements without parameterization or input sanitization. The affected CPE is cpe:2.3:a:raisulislamg4:student_management_system_by_php:*:*:*:*:*:*:*:* with the wildcard version field reflecting the rolling release model up to commit 310d950e09013d5133c6b9210aff9444382d16d1.

RemediationAI

No vendor-released patch identified at time of analysis - the project maintainer was notified via GitHub issue (https://github.com/raisulislamg4/student_management_system_by_php/issues/3) but has not responded. Operators should immediately replace the vulnerable SQL construction in delete.php by rewriting all queries that consume user_id, course_id, teacher_id, student_id, and application_id to use PDO or mysqli prepared statements with bound parameters, and apply strict server-side type validation (integer casting) on those identifiers. As compensating controls until a fix is upstream, restrict access to delete.php behind authenticated admin sessions and enforce authorization checks (note: this changes application behavior if delete.php is currently reachable without login), deploy a WAF rule blocking SQL metacharacters in those parameters (risk: legitimate values may be blocked, and WAFs are bypassable), or take the deployment offline. Consult the VulDB advisory at https://vuldb.com/vuln/367505 for additional context.