Is there a public PoC exploit available for CVE-2026-9575?

Yes, a public proof-of-concept exploit is available for CVE-2026-9575. Prioritise patching immediately. EPSS: 0.0%.

Student Transcript System CVE-2026-9575

Q: What is the CVSS score of CVE-2026-9575?

CVE-2026-9575 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31963 MEDIUM

SQL Injection (CWE-89)

2026-05-26 VulDB

GHSA-79mh-f646-j394

PHP SQLi Student Transcript Processing System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:31 vuln.today

Severity Changed

May 26, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the file /admin/modules/class/index.php?view=view. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Student Transcript Processing System 1.0 exposes the admin panel endpoint /admin/modules/class/index.php?view=view to remote unauthenticated database manipulation via the unsanitized id parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially reachable from the network. A public proof-of-concept exploit has been disclosed on GitHub, and SSVC flags this as automatable with partial technical impact - though EPSS at 0.03% (9th percentile) reflects limited observed in-the-wild activity; no public exploit identified at time of analysis reaching KEV status.

Technical ContextAI

The affected application is a PHP-based academic web system (CPE: cpe:2.3:a:itsourcecode:student_transcript_processing_system:*:*:*:*:*:*:*:*) designed for managing student transcript records. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the id query parameter supplied to the view action of /admin/modules/class/index.php is concatenated directly into a backend SQL query without sanitization or parameterization. This classic PHP-era anti-pattern allows an attacker to inject arbitrary SQL syntax, reshaping query logic to read, modify, or enumerate database contents. The wildcard in the CPE version field indicates NVD has not scoped the flaw to a narrowly bounded version range, though EUVD explicitly names version 1.0 as affected.

RemediationAI

No vendor-released patch has been identified at time of analysis - itsourcecode has not published a fixed version or security advisory through their site (https://itsourcecode.com/). As an immediate compensating control, restrict network access to the /admin/ directory via web server configuration (Apache .htaccess IP allowlisting or nginx allow/deny directives), limiting reachability to trusted administrative IP ranges; note this does not remediate the underlying flaw and adds operational friction for legitimate admins. Deploying a WAF rule to reject requests containing SQL metacharacters (single quotes, UNION, SELECT) in the id parameter of this endpoint can reduce automated exploitation risk, but is bypassable via encoding and obfuscation techniques. The permanent fix requires replacing dynamic SQL string concatenation with parameterized prepared statements in the PHP source. Organizations should consider taking the application offline or isolating it behind a VPN until a code-level fix is applied. Reference the VulDB advisory at https://vuldb.com/vuln/365634 for ongoing tracking.