Which versions of CollegeManagementSystem are affected by CVE-2026-11334?

tittuvarghese CollegeManagementSystem contains a remote SQL injection vulnerability allowing unauthenticated attackers to access and modify student records through the department code parameter in…

Is there a public PoC exploit available for CVE-2026-11334?

Yes, a public proof-of-concept exploit is available for CVE-2026-11334. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11334?

Within 24 hours: Identify all institutional deployments and assess exposure; implement Web Application Firewall (WAF) rules to block SQL injection patterns in department_code requests. Within 7 days: Deploy input validation (restrict department_code to numeric values only) and replace dynamic SQL queries with parameterized statements in fetch.php; enable database audit logging. Within 30 days: Evaluate transition to maintained alternatives or establish internal fork with security patching capability; implement continuous monitoring and alerting for SQL injection attempts.

CollegeManagementSystem CVE-2026-11334

Q: What is the CVSS score of CVE-2026-11334?

CVE-2026-11334 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34839 MEDIUM

SQL Injection (CWE-89)

2026-06-05 VulDB

GHSA-2hj8-vpq3-ppqc

PHP SQLi Collegemanagementsystem Tittuvarghese

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 05, 2026 - 15:22 NVD

HIGH MEDIUM

CVSS changed

Jun 05, 2026 - 15:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 05, 2026 - 15:02 vuln.today

DescriptionCVE.org

A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This affects an unknown function of the file dashboard_page/forms/fetch.php. Performing a manipulation of the argument department_code results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in tittuvarghese CollegeManagementSystem (rolling-release PHP project) allows remote unauthenticated attackers to manipulate the department_code parameter in dashboard_page/forms/fetch.php to inject arbitrary SQL. Publicly available exploit code exists (disclosed via VulDB and a GitHub issue), and because the project uses continuous delivery with no tagged versions, defenders cannot pin a fixed release. The maintainer has been notified but has not responded, increasing operational risk for any deployment.

Technical ContextAI

The affected component is a PHP endpoint (dashboard_page/forms/fetch.php) in an open-source College Management System tracked by CPE cpe:2.3:a:tittuvarghese:collegemanagementsystem. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the department_code request argument is concatenated into a SQL query without parameterization or proper escaping, allowing attacker-controlled SQL syntax to alter query logic. Such flaws in PHP/MySQL stacks typically arise from direct use of $_GET/$_POST values inside mysqli_query or legacy mysql_* calls without prepared statements.

RemediationAI

No vendor-released patch identified at time of analysis - the maintainer was notified via https://github.com/tittuvarghese/CollegeManagementSystem/issues/3 but has not responded. Operators should immediately patch the code locally by rewriting the query in dashboard_page/forms/fetch.php to use parameterized statements (mysqli prepared statements with bind_param or PDO with bound parameters) for the department_code input and apply strict allowlist validation (e.g., regex for expected alphanumeric department codes). As compensating controls, place the application behind a web application firewall with SQLi signatures tuned for the department_code parameter (accepting the false-positive risk on legitimate special characters), restrict network access to the dashboard_page directory to authenticated internal users via reverse-proxy ACLs (side effect: breaks any public-facing usage), and ensure the database account used by the app has least-privilege rights (no DROP, FILE, or cross-database SELECT) to limit blast radius. Monitor https://github.com/tittuvarghese/CollegeManagementSystem/ for an upstream fix commit since no tagged release exists.