School Management System EUVD-2026-116528

Exploitation targets the 'email' argument of parent_Login.php in the Public Search Feature; the CVSS vector (PR:N/UI:N) indicates unauthenticated access with no user interaction, consistent with a pre-login/public endpoint, so a default internet-exposed deployment of sumiie24 School-Management-System is reachable remotely. The trigger mechanism beyond 'manipulation of the email argument leading to SQL injection' is not detailed in the available sources. Limiting factors: the product has a very small real-world footprint (obscure open-source project), and because it ships as a rolling release there is no disclosed fixed version or vendor advisory to confirm affected ranges - the only version anchor is commit d946d649c7c95e101fc5679ecd91999533bb10d7 and earlier.

The CVSS 4.0 score is 6.9 (medium), with a vector describing a fully remote, unauthenticated, low-complexity attack (AV:N/AC:L/AT:N/PR:N/UI:N) and low impact to confidentiality, integrity and availability (VC:L/VI:L/VA:L). The E:P (Proof-of-Concept) exploit maturity aligns with the input showing a public PoC reference that is not verified as working exploit code. There is no CISA KEV listing and no EPSS score in the provided data, so there is no signal of active or widespread exploitation; absence of EPSS/KEV is not itself an error but it limits confidence in real-world weaponization. The vuln.today Decision label is 'this_month', indicating a near-term but non-emergency remediation priority - consistent with a medium-severity, remotely reachable SQL injection on an obscure product. The practical risk is tempered by prevalence: this is a small open-source school-management project, not widely deployed enterprise software, so mass exploitation is unlikely even though the flaw is remotely reachable. Note a data gap: the vendor was contacted but did not respond, there is no vendor advisory, and because the product uses a rolling release, no fixed version is disclosed - meaning no confirmed patch exists to point defenders toward.

A remote attacker submits a crafted value in the 'email' argument to parent_Login.php (the Public Search Feature) without needing credentials, and the unsanitized input is concatenated into a SQL query. Because the login/search endpoint is internet-reachable and requires no authentication or user interaction, the attacker can manipulate the backend query to read or alter database contents. A public PoC reference exists (a GitHub issue), but it is not verified as working exploit code.