EUVD-2026-35154
GHSA-3pq7-6jpj-cm4p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This affects an unknown function of the file /index.ph of the component Login. Such manipulation of the argument usr/pwd leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
SQL injection in imvks786 Student Management System (rolling release up to commit 9599b560) allows remote unauthenticated attackers to manipulate the usr and pwd parameters of /index.ph in the Login component to inject arbitrary SQL. Publicly available exploit code exists per VulDB, though the project is on a rolling release with no tagged fix and the maintainer has not responded to the issue report. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be a deployed instance of imvks786/student_management_system with the Login page at /index.ph network-reachable to the attacker and backed by a SQL database; no authentication, no user interaction, and no special configuration is required because the injection lives in the pre-authentication login handler itself. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.3 with vector AV:N/AC:L/PR:N/UI:N reflects a network-reachable, low-complexity, unauthenticated attack - strong indicators of practical exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends a POST request to /index.ph with a crafted usr value such as admin' OR '1'='1'-- and any pwd, bypassing authentication and returning the first row in the users table to log in as that account. Publicly available exploit code per VulDB lowers the skill barrier; a follow-on UNION-based injection through the same parameters can be used to exfiltrate the full student and credential database from the underlying MySQL/MariaDB instance. |
| Remediation | No vendor-released patch identified at time of analysis - the maintainer was notified via the GitHub issue but has not responded, and the rolling release model provides no fixed version to upgrade to. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all instances of imvks786 Student Management System in production and assess network exposure; review access logs for suspicious login activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today