Is there a public PoC exploit available for CVE-2026-11585?

Yes, a public proof-of-concept exploit is available for CVE-2026-11585. Prioritise patching immediately. EPSS: 0.0%.

Student Attendance Management System CVE-2026-11585

Q: What is the CVSS score of CVE-2026-11585?

CVE-2026-11585 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35199 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

PHP SQLi Student Attendance Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 21:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 08, 2026 - 21:20 vuln.today

DescriptionCVE.org

A vulnerability was determined in CodeAstro Student Attendance Management System 1.0. Affected is an unknown function of the file /attendance-php/Admin/createClassArms.php. This manipulation of the argument classId causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in CodeAstro Student Attendance Management System 1.0 exposes the backend database to manipulation by authenticated remote attackers via the classId parameter in /attendance-php/Admin/createClassArms.php. An attacker with low-privilege authenticated access to the admin panel can craft malicious SQL payloads to read, alter, or delete database records - impacting confidentiality, integrity, and availability (C:L/I:L/A:L per CVSS). A public proof-of-concept exploit exists (GitHub issue, VulDB reference), elevating practical risk beyond the moderate CVSS score of 6.3 alone. No CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CodeAstro Student Attendance Management System 1.0 is a PHP-based web application (tag: PHP) designed for educational institutions. The vulnerable endpoint /attendance-php/Admin/createClassArms.php accepts a classId parameter that is passed unsanitized into an underlying SQL query, constituting a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected CPE is cpe:2.3:a:codeastro:student_attendance_management_system:*:*:*:*:*:*:*:*, where the wildcard version field suggests the CPE covers all releases, though only version 1.0 is explicitly confirmed in the description. The root cause is the absence of parameterized queries or prepared statements in the PHP data-access layer, a well-understood and preventable code pattern.

RemediationAI

No vendor-released patch has been identified at time of analysis - the available references point to VulDB (https://vuldb.com/vuln/369182) and a public POC issue (https://github.com/Andelstander/cve/issues/10), neither of which confirm a fixed release. Organizations running this product should immediately apply parameterized queries or prepared statements to the classId input in createClassArms.php as the definitive fix. As a compensating control, restrict access to the admin panel (/attendance-php/Admin/) to trusted IP ranges via web server ACLs or a WAF rule - this does not eliminate the vulnerability but raises the barrier for unauthenticated or remote exploitation. Deploying a WAF with SQLi signature detection (e.g., ModSecurity CRS rule 942100) can detect and block common injection payloads with the trade-off of potential false positives on legitimate inputs. Rotate all admin credentials and audit the database for signs of unauthorized reads or modifications. Monitor the vendor site at https://codeastro.com/ for a patched release.