Is there a public PoC exploit available for CVE-2026-11583?

Yes, a public proof-of-concept exploit is available for CVE-2026-11583. Prioritise patching immediately. EPSS: 0.0%.

Student Attendance Management System CVE-2026-11583

Q: What is the CVSS score of CVE-2026-11583?

CVE-2026-11583 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35195 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

PHP SQLi Student Attendance Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 20:24 vuln.today

Severity Changed

Jun 08, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 20:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendance-php/Admin/createClass.php. The manipulation of the argument className leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in CodeAstro Student Attendance Management System 1.0 allows low-privileged authenticated remote attackers to manipulate backend database queries via the unsanitized className parameter in /attendance-php/Admin/createClass.php. A publicly available proof-of-concept exploit (CVSS E:P) lowers the barrier to exploitation, though the CVSS 4.0 score of 2.1 (Low) reflects constrained impact scope - all confidentiality, integrity, and availability impacts are rated Low with no scope change. No confirmed active exploitation (not in CISA KEV) has been identified at time of analysis.

Technical ContextAI

The affected product is a PHP-based web application for managing student attendance records, identified by CPE cpe:2.3:a:codeastro:student_attendance_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection arising from direct interpolation of user-controlled input into SQL queries without parameterization or escaping. Specifically, the className parameter submitted to the /attendance-php/Admin/createClass.php admin endpoint is passed unsanitized to a database query, enabling arbitrary SQL manipulation. This pattern is common in small PHP applications that rely on string concatenation rather than prepared statements or an ORM layer.

RemediationAI

No vendor-released patch has been identified at time of analysis - no patched version number is confirmed from available data. Developers should remediate the root cause by replacing string-concatenated SQL queries in /attendance-php/Admin/createClass.php with parameterized prepared statements (e.g., PHP PDO or MySQLi with bound parameters), which eliminates the injection surface entirely. As a compensating control, restrict access to the /attendance-php/Admin/ directory to trusted IP ranges using web server access controls (Apache .htaccess Require ip directives or nginx allow/deny blocks) - note this reduces exposure but does not fix the underlying flaw. Enforce strong, unique credentials for all admin accounts and consider deploying a WAF rule targeting SQL metacharacter patterns in form POST parameters. Monitor VulDB at https://vuldb.com/vuln/369180 and the vendor site at https://codeastro.com/ for any official patch release.