University Management System
CVE-2026-3740
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SQL payload in admin_search_student parameter
-
ExploitSend HTTP request to /admin_search_student.php
-
ExecutionExecute unauthorized database query
-
ImpactExtract sensitive student records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | itsourcecode University Management System 1.0 with /admin_search_student.php endpoint accessible. No authentication required; default deployment vulnerable to remote unauthenticated SQL injection attacks. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in itsourcecode University Management System 1.0 allows remote attackers to manipulate the admin_search_student parameter in /admin_search_student.php without authentication, potentially leading to unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available.
Earlier versions of this analysis (1)
A weakness has been identified in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_search_student.php. [CVSS 7.3 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects University Management System. A weakness has been identified in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_search_student.php. This manipulation of the argument admin_search_student causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Know when University Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_search_student.php. This manipulation of the argument admin_search_student causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
A high-severity vulnerability in the University Management System's student search function could allow unauthorized access to sensitive student data and administrative functions. With public exploits already available and no patch released, immediate action is required to protect student records and institutional liability.
Deploy Web Application Firewall (WAF) rules to block suspicious requests to /admin_search_student.php; implement network segmentation to restrict admin panel access to authorized administrative networks only; disable the student search feature if operationally feasible; enforce multi-factor authentication on all admin accounts; implement rate limiting and request validation; increase monitoring and alerting on admin panel access; consider disabling the vulnerable application until patch availability or replacement is complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Related Vulnerabilities in itsourcecode University Management System SQL Injection
View all 5More in University Management System
View allA vulnerability classified as critical has been found in itsourcecode University Management System 1.0. Rated medium sev
A vulnerability classified as problematic was found in CodeAstro University Management System 1.0. Rated medium severity
SQL injection in itsourcecode University Management System 1.0 via the ID parameter in /admin_single_student.php allows
SQL injection in itsourcecode University Management System 1.0 via the ID parameter in /admin_single_student_update.php
SQL injection in itsourcecode University Management System 1.0 via the Name parameter in /att_add.php enables unauthenti
A vulnerability classified as critical was found in itsourcecode University Management System 1.0. Rated medium severity
A vulnerability was found in itsourcecode University Management System 1.0. Rated medium severity (CVSS 5.3), this vulne
A vulnerability has been found in itsourcecode University Management System 1.0 and classified as critical. Rated medium
A vulnerability classified as problematic has been found in CodeAstro University Management System 1.0. Rated medium sev
Exploit-DB