Is there a public PoC exploit available for CVE-2026-9474?

Yes, a public proof-of-concept exploit is available for CVE-2026-9474. Prioritise patching immediately. EPSS: 0.0%.

StudentManagementSystem CVE-2026-9474

Q: What is the CVSS score of CVE-2026-9474?

CVE-2026-9474 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31707 MEDIUM

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-hhgw-mw5j-wjh8

PHP SQLi Studentmanagementsystem

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:33 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:07 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in yashpokharna2555 StudentManagementSystem up to cb2f558ddf8d19396de0f92abf2d224d46a0a203. Affected by this issue is the function confirm_logged_in of the file /studentdel.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in yashpokharna2555 StudentManagementSystem's /studentdel.php endpoint allows remote unauthenticated attackers to manipulate the ID parameter within the confirm_logged_in function, enabling arbitrary SQL query execution against the backend database. All commits up to cb2f558ddf8d19396de0f92abf2d224d46a0a203 of this PHP-based academic application are affected, with no patched release available due to its rolling-release model and vendor non-response. A public exploit exists per GitHub issue #5, and SSVC flags the attack as automatable, though the EPSS score of 0.03% reflects limited real-world scanning activity likely attributable to the application's narrow deployment footprint.

Technical ContextAI

The affected application is a PHP-based student management web system (CPE: cpe:2.3:a:yashpokharna2555:studentmanagementsystem:*:*:*:*:*:*:*:*) hosted on GitHub as an open-source academic project. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic first-order SQL injection arising from unsanitized concatenation of the user-supplied ID parameter directly into SQL query strings within the confirm_logged_in function in /studentdel.php. The absence of parameterized queries or prepared statements - standard PHP PDO or MySQLi features that would prevent this class of vulnerability - indicates the codebase lacks fundamental input handling safeguards. Because the application operates on a rolling release without semantic versioning, the affected surface is defined by commit hash rather than release number.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer was notified via GitHub issue but has not responded. As an immediate compensating control, restrict external access to /studentdel.php at the web server level (e.g., via Apache .htaccess Deny directives or nginx location blocks), which removes the unauthenticated attack surface without affecting other application functionality. Deploy a web application firewall rule to block SQL metacharacters (single quotes, comment sequences, UNION keywords) in the ID parameter; note this is a defense-in-depth measure and not a substitute for a code fix. If student deletion functionality is non-essential, disable or remove /studentdel.php entirely until remediated. For a permanent fix, the ID parameter in confirm_logged_in must be sanitized using PHP PDO prepared statements or MySQLi parameterized queries; the fix should be applied directly in the source and deployed. Placing the entire application behind network-level authentication (VPN, HTTP basic auth) would significantly limit exploitation risk as a stopgap. Monitor VulDB advisory https://vuldb.com/vuln/365455 for any upstream patch commits.