Is there a public PoC exploit available for CVE-2026-9469?

Yes, a public proof-of-concept exploit is available for CVE-2026-9469. Prioritise patching immediately. EPSS: 0.0%.

StudentManagementSystem CVE-2026-9469

Q: What is the CVSS score of CVE-2026-9469?

CVE-2026-9469 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31701 MEDIUM

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-fprv-crc3-xg8m

PHP SQLi Studentmanagementsystem

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:46 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:07 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A weakness has been identified in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. The impacted element is an unknown function of the file /success.php. This manipulation of the argument User causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in the PHP-based yashpokharna2555/StudentManagementSystem exposes the /success.php endpoint to remote unauthenticated database attacks via the unsanitized 'User' argument. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position. A publicly available exploit exists via a GitHub issue report; the project maintainer has been notified but has not responded, and no patch has been released. Despite POC availability, EPSS sits at 0.03% (9th percentile), reflecting the niche, low-adoption nature of this project rather than a reduced technical severity.

Technical ContextAI

The affected application is a PHP-based student management system (CPE: cpe:2.3:a:yashpokharna2555:studentmanagementsystem:*:*:*:*:*:*:*:*) hosted on GitHub under a rolling release model with no discrete versioned releases. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection class caused by concatenating user-supplied input directly into SQL query strings without parameterization or escaping. The specific sink is the 'User' argument processed by /success.php, which passes attacker-controlled data to the backend database query. PHP applications of this type typically use MySQLi or PDO; the absence of prepared statements or input sanitization in this code path is the direct root cause.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the responsible disclosure report filed at https://github.com/yashpokharna2555/StudentManagementSystem/issues/2. The primary fix requires rewriting the /success.php database query to use parameterized prepared statements (PDO or MySQLi prepared statements in PHP), which eliminates the injection surface entirely. Until a code fix is applied, administrators should consider blocking or restricting external access to /success.php at the web server or WAF layer - this eliminates remote exploitability but also removes functionality for legitimate users. A WAF rule targeting SQL metacharacter patterns in the User parameter (single quotes, UNION, SELECT keywords) can provide partial protection but is bypassable and should not be treated as a permanent control. Disabling the application entirely for internet-exposed deployments is the most conservative interim option given the zero-authentication exploitation path.