Is there a public PoC exploit available for CVE-2026-12175?

Yes, a public proof-of-concept exploit is available for CVE-2026-12175. Prioritise patching immediately. EPSS: 0.0%.

Student Attendance System CVE-2026-12175

Q: What is the CVSS score of CVE-2026-12175?

CVE-2026-12175 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36655 LOW

SQL Injection (CWE-89)

2026-06-13 VulDB

GHSA-hwp5-9mfw-v2fq

PHP SQLi Student Attendance Management System Codeastro

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Admin panel access required before injection is reachable (PR:H); SQL injection yields bounded DB read/write with no OS-level or cross-system scope change (S:U, C:L/I:L/A:L).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 13, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jun 13, 2026 - 23:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jun 13, 2026 - 23:21 vuln.today

DescriptionCVE.org

A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStudents.php. Performing a manipulation of the argument admissionNumber results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

SQL injection in CodeAstro Student Attendance Management System 1.0 enables authenticated administrators to manipulate the admissionNumber parameter in /attendance-php/Admin/createStudents.php, allowing arbitrary SQL commands to be passed to the underlying database. Exploitation is constrained to actors who already hold high-privilege admin credentials (PR:H per the CVSS 4.0 vector), but impact spans database confidentiality, integrity, and availability. A public proof-of-concept exploit is available on GitHub; the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

This is a CWE-89 (Improper Neutralization of Special Elements used in SQL Commands) vulnerability in a PHP-based student attendance web application. The affected file /attendance-php/Admin/createStudents.php constructs SQL queries via direct string interpolation of the user-supplied admissionNumber parameter, bypassing parameterized query protections. CPE cpe:2.3:a:codeastro:student_attendance_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected range to a specific release - all deployed instances should be treated as vulnerable. CodeAstro produces small-footprint educational PHP applications commonly deployed on shared hosting, where WAF and database egress controls are often absent. The absence of input sanitization at an admin-facing data entry endpoint is consistent with a pattern common in low-assurance educational software.

RemediationAI

No vendor-released patch has been identified at time of analysis - patch status is absent from all available references. Developers or administrators with source access should immediately refactor /attendance-php/Admin/createStudents.php to use PHP PDO or MySQLi prepared statements with bound parameters for all SQL queries accepting the admissionNumber input, eliminating the injection surface entirely. As an immediate compensating control, restrict access to the admin panel directory (/attendance-php/Admin/) to trusted IP addresses via web server configuration (Apache .htaccess or Nginx allow/deny directives) or upstream firewall rules - this prevents unauthenticated network reconnaissance and limits the attacker pool even if credentials are later compromised. Deploying a WAF with OWASP Core Rule Set SQL injection signatures can provide detection and blocking, though this may produce false positives on legitimate student ID formats. Monitor the VulDB entry at https://vuldb.com/vuln/370816 and the vendor site at https://codeastro.com/ for patch availability. The public POC at https://github.com/fgvcbv/cve/issues/1 can be referenced to validate any applied fix.