Is there a public PoC exploit available for CVE-2026-11475?

Yes, a public proof-of-concept exploit is available for CVE-2026-11475. Prioritise patching immediately. EPSS: 0.0%.

student-management-system CVE-2026-11475

Q: What is the CVSS score of CVE-2026-11475?

CVE-2026-11475 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35006 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-w94m-2g78-42xf

PHP SQLi Student Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 02:29 vuln.today

Severity Changed

Jun 08, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected by this vulnerability is the function getStatus of the file controllers/GradeController.php of the component Certificate Verification Endpoint. Executing a manipulation of the argument nic can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in the getStatus function of controllers/GradeController.php within Kushan2k's student-management-system exposes the Certificate Verification Endpoint to database manipulation by low-privileged remote attackers via the nic parameter. A publicly available exploit (proof-of-concept via GitHub issue) lowers the practical bar for abuse despite the CVSS 4.0 base score of 2.1. No patch has been released, and the maintainer has not responded to responsible disclosure, leaving all deployments through commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a unprotected.

Technical ContextAI

The vulnerability is a textbook CWE-89 (Improper Neutralization of Special Elements in an SQL Command) in a PHP application. The getStatus function in controllers/GradeController.php passes the user-supplied nic argument - likely representing a National Identity Card number used for student certificate lookups - directly into a database query without parameterization or adequate sanitization. This allows an attacker to break out of the intended query context and inject arbitrary SQL. The full affected product scope is captured by CPE cpe:2.3:a:kushan2k:student-management-system:*:*:*:*:*:*:*:*, covering the entire codebase through the identified commit hash. The project is PHP-based with no discrete release versioning, meaning the vulnerable code exists across all forks and deployments that have not independently patched the file.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer was notified via GitHub issue (https://github.com/Kushan2k/student-management-system/issues/2) but has not responded. The definitive fix is to refactor the getStatus function in controllers/GradeController.php to use PHP PDO or MySQLi prepared statements for the nic parameter, which eliminates the injection surface entirely. As an immediate compensating control, restrict access to the Certificate Verification Endpoint to the minimum necessary authenticated user roles and consider disabling it entirely if not in active operational use - this raises the bar from PR:L to no access at all. Deploying a WAF rule targeting SQL injection patterns in the nic parameter provides a secondary layer but is bypass-prone and should not be treated as equivalent to a code fix. Monitor the GitHub repository and VulDB entry at https://vuldb.com/vuln/369095 for any upstream patch commits.