Which versions of Student Management System are affected by CVE-2026-11530?

SQL injection vulnerability in imvks786 Student Management System login component allows remote attackers to manipulate database queries through the /index.php endpoint, potentially compromising…

Is there a public PoC exploit available for CVE-2026-11530?

Yes, a public proof-of-concept exploit is available for CVE-2026-11530. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11530?

24 hours: Identify all instances of imvks786 Student Management System in production and assess network exposure; review access logs for suspicious login activity. 7 days: Deploy Web Application Firewall (WAF) rules blocking SQL injection patterns on /index.php; implement network segmentation restricting login access to trusted IP ranges; enable database query logging. 30 days: Contact imvks786 maintainer for vulnerability patch status; evaluate migration to alternative, actively maintained Student Management Systems with security support.

Student Management System CVE-2026-11530

Q: What is the CVSS score of CVE-2026-11530?

CVE-2026-11530 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35154 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-3pq7-6jpj-cm4p

SQLi Student Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 17:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 17:15 vuln.today

DescriptionCVE.org

A vulnerability was identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This affects an unknown function of the file /index.ph of the component Login. Such manipulation of the argument usr/pwd leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in imvks786 Student Management System (rolling release up to commit 9599b560) allows remote unauthenticated attackers to manipulate the usr and pwd parameters of /index.ph in the Login component to inject arbitrary SQL. Publicly available exploit code exists per VulDB, though the project is on a rolling release with no tagged fix and the maintainer has not responded to the issue report. No CISA KEV listing and no EPSS score is provided, but the trivial network-reachable login vector makes opportunistic scanning likely.

Technical ContextAI

The affected component is a PHP-based web application (imvks786/student_management_system on GitHub) that exposes a Login endpoint at /index.ph accepting usr and pwd parameters. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the login handler concatenates user-supplied credentials directly into a SQL query without parameterized statements or proper escaping. Per CPE cpe:2.3:a:imvks786:student_management_system:*:*:*:*:*:*:*:*, all versions up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46 are in scope, and because the project uses a rolling release model there is no semantic version boundary distinguishing vulnerable from fixed code.

RemediationAI

No vendor-released patch identified at time of analysis - the maintainer was notified via the GitHub issue but has not responded, and the rolling release model provides no fixed version to upgrade to. As compensating controls, operators should remove the application from internet exposure or place it behind an authenticated reverse proxy or VPN, and deploy a Web Application Firewall rule blocking SQL meta-characters (single quote, UNION, --, ;) on POST parameters usr and pwd to /index.ph, accepting the trade-off that legitimate credentials containing apostrophes will be rejected. Locally patch the Login handler to use PDO or mysqli prepared statements with bound parameters for usr and pwd before redeploying, and rotate any database credentials that may have been exposed; consult https://vuldb.com/vuln/369147 and the GitHub issue at https://github.com/imvks786/student_management_system/issues/1 for tracking upstream remediation.