Which versions of Simple E Learning System are affected by CVE-2026-4574?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4574, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4574?

Yes, a public proof-of-concept exploit is available for CVE-2026-4574. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4574?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Simple E Learning System CVE-2026-4574

Q: What is the CVSS score of CVE-2026-4574?

CVE-2026-4574 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14365 LOW

SQL Injection (CWE-89)

2026-03-23 VulDB

SQLi Simple E Learning System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 05:45 euvd

EUVD-2026-14365

Analysis Generated

Mar 23, 2026 - 05:45 vuln.today

CVE Published

Mar 23, 2026 - 05:01 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handler. The manipulation of the argument firstName results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Simple E-learning System 1.0's user profile update functionality allows authenticated remote attackers to manipulate the firstName parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to read or modify sensitive database information. No patch is currently available.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) affecting SourceCodester Simple E-learning System version 1.0, confirmed via CPE cpe:2.3:a:sourcecodester:simple_e-learning_system:*:*:*:*:*:*:*:*. The User Profile Update Handler component fails to properly sanitize or parameterize user input from the firstName field before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL commands by crafting malicious firstName values, bypassing authentication and authorization controls. The vulnerability is network-accessible and requires only standard user-level privileges to exploit, indicating insufficient input validation in the application's backend database interaction logic.

RemediationAI

Immediately upgrade SourceCodester Simple E-learning System to a patched version released after the disclosure, with confirmation from https://www.sourcecodester.com/. If immediate patching is not possible, implement the following interim controls: enforce input validation on the firstName parameter using allowlist-based sanitization (permitting only alphabetic characters and spaces), apply parameterized queries or prepared statements for all database interactions, implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in user profile update requests, restrict profile update functionality to specific trusted internal networks only, and enable comprehensive SQL error logging to detect exploitation attempts. Additionally, conduct a database audit to identify any unauthorized modifications resulting from exploitation during the vulnerability window.