Is there a public PoC exploit available for CVE-2026-11584?

Yes, a public proof-of-concept exploit is available for CVE-2026-11584. Prioritise patching immediately. EPSS: 0.0%.

Student Attendance Management System CVE-2026-11584

Q: What is the CVSS score of CVE-2026-11584?

CVE-2026-11584 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35198 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

PHP SQLi Student Attendance Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 20:24 vuln.today

Severity Changed

Jun 08, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 20:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in CodeAstro Student Attendance Management System 1.0. This impacts an unknown function of the file /attendance-php/Admin/createClass.php?action=edit. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in CodeAstro Student Attendance Management System 1.0 exposes the /attendance-php/Admin/createClass.php?action=edit endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers with low-privilege access can exploit this to read, modify, or partially disrupt database contents. A public exploit exists (reported via GitHub), though the CVSS 4.0 score of 2.1 reflects constrained real-world impact due to limited scope change and low-severity confidentiality/integrity/availability ratings - no public exploit identified in CISA KEV at time of analysis.

Technical ContextAI

The affected application is a PHP-based student attendance management system (CPE: cpe:2.3:a:codeastro:student_attendance_management_system:*:*:*:*:*:*:*:*) developed by CodeAstro. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the application directly interpolates user-supplied input - specifically the 'ID' parameter - into a database query without adequate sanitization or use of parameterized/prepared statements. The vulnerable file is /attendance-php/Admin/createClass.php, triggered when the 'action=edit' query parameter is set. The wildcard version in the CPE string suggests the flaw may not be version-bounded to 1.0 alone, but no additional version data is confirmed in the available intelligence.

RemediationAI

No vendor-released patch has been identified at time of analysis; the CodeAstro website (https://codeastro.com/) does not appear to have published a security advisory. The primary fix should be refactoring /attendance-php/Admin/createClass.php to use PHP PDO or MySQLi prepared statements with bound parameters for the ID value, eliminating the injection vector entirely. As a compensating control, a web application firewall (WAF) rule blocking SQL metacharacter sequences (quotes, UNION, SELECT keywords) in the ID parameter can reduce exploitability at the cost of potential false positives on legitimate IDs. Access to the /Admin/ directory should be restricted at the web server level (e.g., via .htaccess IP allowlisting) to reduce the attack surface, though this does not eliminate the vulnerability for authorized low-privilege users. Input validation enforcing that ID is strictly an integer would also neutralize this specific vector without removing functionality. Defenders should monitor database query logs for anomalous patterns consistent with UNION-based or error-based SQL injection attempts against this endpoint.