Which versions of Teacher Record System are affected by CVE-2026-5182?

SourceCodester Teacher Record System 1.0 contains an unauthenticated SQL injection vulnerability (CVE-2026-5182) in the searchteacher parameter that allows remote attackers to execute arbitrary…

Is there a public PoC exploit available for CVE-2026-5182?

Yes, a public proof-of-concept exploit is available for CVE-2026-5182. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5182?

Within 24 hours: Identify all instances of SourceCodester Teacher Record System 1.0 in production and isolate them from public network access or disable the searchteacher functionality. Within 7 days: Contact SourceCodester for patch availability and timeline; implement Web Application Firewall (WAF) rules to block malicious SQL injection patterns in the searchteacher parameter. Within 30 days: Evaluate migration to a supported alternative system or conduct a comprehensive security audit of the application before restoring public access; review database access logs for evidence of exploitation.

Teacher Record System CVE-2026-5182

Q: What is the CVSS score of CVE-2026-5182?

CVE-2026-5182 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17329 MEDIUM

SQL Injection (CWE-89)

2026-03-31 VulDB

SQLi Teacher Record System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 06:00 euvd

EUVD-2026-17329

Analysis Generated

Mar 31, 2026 - 06:00 vuln.today

CVE Published

Mar 31, 2026 - 05:45 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in SourceCodester Teacher Record System 1.0. Impacted is an unknown function of the file Teacher Record System of the component Parameter Handler. Performing a manipulation of the argument searchteacher results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Teacher Record System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'searchteacher' parameter in the Parameter Handler component. The vulnerability has a publicly available exploit (GitHub POC published), enabling extraction of sensitive data, modification of database records, or potential system compromise. CVSS 7.3 (High severity) with low attack complexity and no authentication required indicates significant exploitation risk.

Technical ContextAI

This vulnerability is a classic SQL injection (CWE-89) affecting SourceCodester Teacher Record System version 1.0, identified by CPE 2.3:a:sourcecodester:teacher_record_system:*:*:*:*:*:*:*:*. SQL injection occurs when user-supplied input is improperly sanitized before being incorporated into SQL queries. The 'searchteacher' parameter in the Parameter Handler component fails to validate or escape special characters, allowing attackers to inject malicious SQL syntax. This permits direct interaction with the backend database, bypassing application logic. The vulnerability represents a fundamental failure in input validation, a common issue in custom-developed web applications lacking secure coding practices or parameterized query implementations.

RemediationAI

No vendor-released patch has been identified at time of analysis. SourceCodester projects are often proof-of-concept applications without formal security maintenance or update channels. Immediate mitigation requires implementing input validation and parameterized queries at the application code level for the searchteacher parameter and all database interactions. Organizations should conduct comprehensive code review to identify additional SQL injection vectors, implement web application firewall rules to filter malicious SQL syntax in HTTP parameters, apply principle of least privilege to database accounts used by the application, and monitor database logs for suspicious query patterns. Given the lack of vendor support, organizations should consider migrating to actively maintained commercial or open-source teacher management systems with established security practices. Technical details and exploit methodology are available at vuldb.com/vuln/354250 and github.com/dyh1213-wq/cve/issues/6 for defensive analysis.