Is there a public PoC exploit available for CVE-2026-19710?

Yes, a public proof-of-concept exploit is available for CVE-2026-19710. Prioritise patching immediately. EPSS: 0.3%.

Simple Student Information System CVE-2026-19710

Q: What is the CVSS score of CVE-2026-19710?

CVE-2026-19710 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-58068 MEDIUM

SQL Injection (CWE-89)

2026-08-13 VulDB

GHSA-4h46-fw44-8mx2

PHP SQLi Simple Student Information System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable SQL injection requiring no authentication maps to AV:N/PR:N; scope unchanged; partial CIA impact consistent with the provided CVSS 4.0 impact metrics.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 13, 2026 - 16:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 16:20 vuln.today

CVE Published

Aug 13, 2026 - 15:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Simple Student Information System exposes the admin department view endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter in app/admin/departments/view_department.php. A public proof-of-concept is available through a GitHub issue, confirmed by VulDB (EUVD-2026-58068), lowering the barrier for opportunistic exploitation. The CVSS 4.0 score of 6.9 with E:P reflects partial confidentiality, integrity, and availability impact - no authentication or special configuration is required based on the provided vector.

Technical ContextAI

The affected product is SourceCodester Simple Student Information System, a PHP-based educational web application (CPE: cpe:2.3:a:sourcecodester:simple_student_information_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 - Improper Neutralization of Special Elements used in an SQL Command - a classic failure to sanitize user-supplied input before incorporating it into a database query. Specifically, the ID parameter passed to app/admin/departments/view_department.php is concatenated directly into an SQL statement without parameterization or escaping. PHP applications that use raw query construction instead of prepared statements are a well-known class of vulnerable targets, and this follows that pattern precisely.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix for CWE-89 is to rewrite the SQL query in app/admin/departments/view_department.php using PDO or MySQLi prepared statements with bound parameters, eliminating the direct concatenation of the ID value. As an immediate compensating control, restrict access to the /admin/ directory to authenticated sessions with server-side enforcement (e.g., .htaccess or application middleware), which would neutralize the PR:N exposure identified in the CVSS vector - note this adds authentication overhead for legitimate admins. Additionally, network-level controls such as placing the admin panel behind a VPN or IP allowlist will prevent remote exploitation. WAF rules targeting common SQL injection patterns (UNION SELECT, OR 1=1, etc.) provide a detection and partial-blocking layer but should not substitute for code-level fixes. Monitor VulDB entry https://vuldb.com/vuln/389368 and the GitHub exploit report at https://github.com/gxcyyjy/CVE/issues/5 for any vendor response or updated patch information.