Skip to main content

Student-Management-System CVE-2026-78056

| EUVDEUVD-2026-64621 LOW
SQL Injection (CWE-89)
2026-08-23 VulDB GHSA-2vw9-w32g-2c7c
SQLi Student Management System
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network-exploitable SQL injection requiring low-privilege authentication per CVSS 4.0 PR:L; limited C/I/A impact with no scope change matches VC:L/VI:L/VA:L in the 4.0 vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Aug 23, 2026 - 03:22 NVD
MEDIUM LOW
CVSS changed
Aug 23, 2026 - 03:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
Analysis Generated
Aug 23, 2026 - 03:00 vuln.today
CVE Published
Aug 23, 2026 - 02:30 cve.org
MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is some unknown functionality of the component Dashboard. The manipulation of the argument roll_no/teacher_name results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in the Dashboard component of sambitraj's Student-Management-System exposes the application to remote database manipulation via the roll_no and teacher_name parameters, affecting all commits through 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. A low-privileged authenticated attacker can inject arbitrary SQL to read or modify student records without any patch or vendor response currently available. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privileged account credentials
Delivery
Authenticate to Dashboard interface
Exploit
Inject SQL payload into roll_no or teacher_name parameter
Execution
Bypass query logic
Impact
Extract or modify student database records
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a low-privileged authenticated session on the Student Management System, consistent with the PR:L metric in the CVSS 4.0 vector - fully unauthenticated external attackers cannot exploit this directly. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) is reasonable: network-accessible with low attack complexity, but requiring authenticated access (PR:L), which moderates real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privileged account on the Student Management System navigates to the Dashboard interface and submits a crafted value such as roll_no=1' OR '1'='1 or teacher_name=admin'-- in the relevant input field. The unsanitized input is interpolated directly into the backend SQL query, allowing the attacker to enumerate student records, extract credentials, or modify data. …
Remediation No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the disclosure filed at https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/4. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Student Management System

View all
CVE-2022-2876 CRITICAL POC
9.8 Aug 18

A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical
CVE-2020-23935 CRITICAL POC
9.8 Aug 20

Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (
CVE-2024-55270 HIGH POC
8.8 Feb 17

phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata
CVE-2024-6191 MEDIUM POC
6.9 Jun 20

A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severi
CVE-2024-5047 MEDIUM POC
6.9 May 17

A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium seve
CVE-2023-3008 CRITICAL
9.8 May 31

A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severi
CVE-2023-3007 CRITICAL
9.8 May 31

A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerab
CVE-2026-10777 MEDIUM POC
5.5 Jun 03

Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to rem
CVE-2026-10619 MEDIUM POC
5.5 Jun 02

Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthentic
CVE-2025-15034 MEDIUM POC
5.5 Dec 23

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands vi
CVE-2025-14967 MEDIUM POC
5.5 Dec 19

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via t
CVE-2025-14661 MEDIUM POC
5.5 Dec 14

SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-78056 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy