Which versions of Student Attendance Management System are affected by CVE-2026-11582?

CodeAstro Student Attendance Management System 1.0 contains a SQL injection vulnerability enabling unauthenticated attackers to access and modify student attendance records and associated personal…

Is there a public PoC exploit available for CVE-2026-11582?

Yes, a public proof-of-concept exploit is available for CVE-2026-11582. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11582?

Within 24 hours: Inventory all CodeAstro 1.0 instances in production; enable database and application audit logging to detect exploitation attempts. Within 7 days: Contact CodeAstro vendor for patch timeline and alternative product recommendations; implement Web Application Firewall rules to block SQL metacharacters in the Username parameter at /attendance-php/index.php; restrict system access to institutional networks only. Within 30 days: Evaluate and select replacement student information system; apply vendor patch immediately upon release or complete migration off CodeAstro 1.0.

Student Attendance Management System CVE-2026-11582

Q: What is the CVSS score of CVE-2026-11582?

CVE-2026-11582 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35190 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

PHP SQLi Student Attendance Management System Codeastro

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 20:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 20:21 vuln.today

DescriptionCVE.org

A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

AnalysisAI

SQL injection in CodeAstro Student Attendance Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter at /attendance-php/index.php to inject arbitrary SQL. Publicly available exploit code exists per VulDB reference, raising the practical risk despite the moderate 7.3 CVSS score. No CISA KEV listing and no EPSS score were supplied, so exploitation appears opportunistic against this small-vendor PHP application rather than mass-targeted.

Technical ContextAI

The affected product (CPE cpe:2.3:a:codeastro:student_attendance_management_system) is a PHP-based student attendance application distributed by CodeAstro, a vendor that publishes free academic/source-code projects often reused in coursework and small deployments. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the Username parameter submitted to /attendance-php/index.php is concatenated into a SQL query without parameterization or proper escaping. Because index.php is the login/landing page, the injection point sits on the pre-authentication request path, which aligns with the PR:N value in the CVSS vector.

RemediationAI

No vendor-released patch identified at time of analysis - CodeAstro has not published a fixed version in the supplied references. Operators should remove /attendance-php/index.php from public exposure immediately, place the application behind authentication or a VPN, and front it with a WAF ruleset blocking SQL injection patterns on the Username parameter (acknowledging WAFs can be bypassed and may break legitimate logins containing special characters). As a code-level fix, replace any string-concatenated SQL with PDO or mysqli prepared statements using bound parameters for the Username field, and audit sibling files under /attendance-php/ for the same pattern. Monitor https://codeastro.com/ and https://vuldb.com/vuln/369179 for an upstream patch, and consider migrating away from this unmaintained academic project to a supported attendance system if production data is at stake.