Is there a public PoC exploit available for CVE-2026-9574?

Yes, a public proof-of-concept exploit is available for CVE-2026-9574. Prioritise patching immediately. EPSS: 0.0%.

Student Transcript System CVE-2026-9574

Q: What is the CVSS score of CVE-2026-9574?

CVE-2026-9574 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31959 MEDIUM

SQL Injection (CWE-89)

2026-05-26 VulDB

GHSA-5mqm-57mv-2wf9

PHP SQLi Student Transcript Processing System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:13 vuln.today

Severity Changed

May 26, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code of the file /admin/modules/student/trans.php. Executing a manipulation of the argument studentId/cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Student Transcript Processing System 1.0 allows remote unauthenticated attackers to manipulate backend database queries by supplying crafted values for the studentId or cid parameters in /admin/modules/student/trans.php. The CVSS 4.0 vector (PR:N, AC:L, UI:N) confirms exploitation requires no authentication and no user interaction, and a proof-of-concept is publicly available via a GitHub issue. No public KEV listing exists and EPSS sits at 0.03% (9th percentile), indicating limited threat-actor uptake thus far - likely due to the narrow deployment footprint of this niche educational PHP application.

Technical ContextAI

The affected product is a PHP-based academic management application distributed by itsourcecode.com, identified by CPE cpe:2.3:a:itsourcecode:student_transcript_processing_system:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the application constructs SQL queries by directly interpolating user-supplied HTTP parameters - studentId and cid - without adequate parameterization or escaping. The affected script, /admin/modules/student/trans.php, handles transcript retrieval or generation logic, and the lack of input sanitization at this data-access boundary is the root cause. The wildcard version component in the CPE string suggests NVD has not bounded the affected range to a specific minor version, though EUVD confirms version 1.0 is affected.

RemediationAI

No vendor-released patch has been identified at time of analysis; the itsourcecode project does not appear to have issued an official fix or security advisory. The primary remediation is to apply manual code-level fixes: replace direct parameter interpolation in SQL queries within /admin/modules/student/trans.php with prepared statements and parameterized queries for the studentId and cid inputs. As an immediate compensating control, restrict network access to the /admin/ directory to trusted IP ranges using web server configuration (e.g., Apache .htaccess or nginx location blocks) - this directly limits the unauthenticated network vector. A web application firewall (WAF) rule targeting SQL injection patterns on the affected parameters can provide an additional detection and blocking layer, though WAF bypass is possible and should not be relied upon as a sole control. If the application is not actively needed, taking the admin interface offline is the lowest-risk interim measure.