EUVD-2026-14365Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handler. The manipulation of the argument firstName results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
AnalysisAI
SQL injection in SourceCodester Simple E-learning System 1.0's user profile update functionality allows authenticated remote attackers to manipulate the firstName parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to read or modify sensitive database information. No patch is currently available.
Technical ContextAI
The vulnerability is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) affecting SourceCodester Simple E-learning System version 1.0, confirmed via CPE cpe:2.3:a:sourcecodester:simple_e-learning_system:*:*:*:*:*:*:*:*. The User Profile Update Handler component fails to properly sanitize or parameterize user input from the firstName field before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL commands by crafting malicious firstName values, bypassing authentication and authorization controls. The vulnerability is network-accessible and requires only standard user-level privileges to exploit, indicating insufficient input validation in the application's backend database interaction logic.
RemediationAI
Immediately upgrade SourceCodester Simple E-learning System to a patched version released after the disclosure, with confirmation from https://www.sourcecodester.com/. If immediate patching is not possible, implement the following interim controls: enforce input validation on the firstName parameter using allowlist-based sanitization (permitting only alphabetic characters and spaces), apply parameterized queries or prepared statements for all database interactions, implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in user profile update requests, restrict profile update functionality to specific trusted internal networks only, and enable comprehensive SQL error logging to detect exploitation attempts. Additionally, conduct a database audit to identify any unauthorized modifications resulting from exploitation during the vulnerability window.
More in Simple E Learning System
View allAn SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.p
A vulnerability was found in SourceCodester Simple E-Learning System. Rated critical severity (CVSS 9.8), this vulnerabi
A vulnerability classified as critical has been found in SourceCodester Simple E-Learning System 1.0. Rated high severit
A vulnerability was found in SourceCodester Simple E-Learning System 1.0. Rated high severity (CVSS 8.8), this vulnerabi
An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learnin
A vulnerability was found in SourceCodester Simple E-Learning System. Rated high severity (CVSS 7.5), this vulnerability
A vulnerability was found in SourceCodester Simple E-Learning System. Rated high severity (CVSS 7.5), this vulnerability
A vulnerability was found in SourceCodester Simple E-Learning System. Rated high severity (CVSS 7.5), this vulnerability
A vulnerability classified as problematic was found in SourceCodester Simple E-Learning System. Rated medium severity (C
A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Rated medium severit
A vulnerability classified as critical was found in SourceCodester Simple E-Learning System. Rated high severity (CVSS 8
SQL injection in SourceCodester Simple E-learning System 1.0 allows authenticated attackers to manipulate the post_id pa
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today