Is there a public PoC exploit available for CVE-2026-11531?

Yes, a public proof-of-concept exploit is available for CVE-2026-11531. Prioritise patching immediately. EPSS: 0.0%.

Student Management System CVE-2026-11531

Q: What is the CVSS score of CVE-2026-11531?

CVE-2026-11531 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35125 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-4m6w-5335-hqmq

PHP SQLi Student Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:23 vuln.today

Severity Changed

Jun 08, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 17:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A security flaw has been discovered in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This impacts an unknown function of the file admin/admin_login.php of the component Administrator Login Endpoint. Performing a manipulation of the argument a_usr/a_pwd results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection at the Administrator Login Endpoint of imvks786's student_management_system (PHP) allows unauthenticated remote attackers to manipulate the a_usr and a_pwd parameters in admin/admin_login.php to inject arbitrary SQL. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no privileges or user interaction required. A public proof-of-concept exploit has been released via GitHub issue tracker; the project maintainer has not responded to disclosure, and no patch is available at time of analysis.

Technical ContextAI

The affected product is a PHP-based student management system developed by imvks786 (CPE: cpe:2.3:a:imvks786:student_management_system:*:*:*:*:*:*:*:*), identified as vulnerable through commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input in the a_usr and a_pwd POST parameters of admin/admin_login.php is passed directly into SQL queries without parameterization or adequate sanitization. This is a classic unsanitized credential injection pattern common in legacy PHP applications that construct queries via string concatenation rather than prepared statements. The login endpoint is the specific attack surface, making authentication bypass the primary attack goal alongside potential data extraction.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer was notified via a GitHub issue report but has not responded. As a primary compensating control, restrict access to admin/admin_login.php at the web server or firewall level so only trusted IP addresses (e.g., internal network ranges) can reach the admin endpoint, eliminating the network-reachable attack surface; note this does not fix the underlying vulnerability and will break legitimate remote admin access. If the application must remain internet-facing, deploying a Web Application Firewall (WAF) with SQL injection signatures in blocking mode can reduce exploitation risk, though WAF bypass is possible against determined attackers. The most effective technical remediation is to refactor admin/admin_login.php to use PHP PDO or MySQLi prepared statements with bound parameters, eliminating the SQL injection root cause entirely. Until a patch is released, monitor web server logs for anomalous POST requests to admin/admin_login.php containing SQL metacharacters (quotes, comment sequences, UNION keywords). Reference: https://vuldb.com/vuln/369148, https://github.com/imvks786/student_management_system/issues/2.