Which versions of Student Management System are affected by EUVD-2026-33558?

The Student Management System deployed in your environment contains a critical SQL injection vulnerability in its login mechanism that allows unauthenticated remote attackers to bypass authentication…

Is there a public PoC exploit available for EUVD-2026-33558?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33558. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-33558?

Within 24 hours: Remove affected systems from public networks if operationally feasible; implement database privilege restrictions to limit damage scope; activate Web Application Firewall rules to block SQL injection attack patterns. Within 7 days: Deploy comprehensive input validation controls and parameterized query enforcement through direct code modification if skilled resources are available; otherwise implement IP whitelisting and network segmentation to restrict access. Within 30 days: Complete migration to a patched, actively maintained Student Management System or retire this application if replacement timelines exceed 30 days.

Student Management System EUVD-2026-33558

Q: What is the CVSS score of EUVD-2026-33558?

EUVD-2026-33558 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10225 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-792c-4q53-6p4v

PHP SQLi Student Management System By Php Raisulislamg4

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 06:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 06:20 vuln.today

DescriptionCVE.org

A vulnerability was detected in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. This issue affects some unknown processing of the file login_check.php of the component Login. Performing a manipulation of the argument Username results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in raisulislamg4's PHP-based Student Management System allows remote unauthenticated attackers to manipulate the Username parameter in login_check.php to inject arbitrary SQL. Publicly available exploit code exists per the GitHub issue tracker, and the project follows a rolling-release model with no fixed version available. The vendor was notified early but has not responded, leaving deployments unpatched.

Technical ContextAI

The affected component is login_check.php, a PHP authentication handler within an open-source Student Management System maintained by GitHub user raisulislamg4 (CPE: cpe:2.3:a:raisulislamg4:student_management_system_by_php). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the Username field is concatenated into a SQL query without parameterization or escaping, allowing query syntax to be altered. Because the vulnerable code path sits in the pre-authentication login flow, the injection is reachable before any credentials are validated.

RemediationAI

No vendor-released patch identified at time of analysis - the maintainer was notified via GitHub issue #2 but has not responded, and no fix commit has been published. Operators should immediately apply compensating controls: rewrite login_check.php to use PDO or mysqli prepared statements with bound parameters for the Username field (the proper fix), or, if direct code modification is not feasible, place the application behind a Web Application Firewall with SQLi signatures tuned to block UNION/boolean/time-based payloads against the /login_check.php endpoint (trade-off: WAF bypasses are common for tautology-based injections). As an interim measure, restrict network exposure of the application to trusted internal networks or VPN-only access, accepting reduced usability for remote students. Track the upstream repository at https://github.com/raisulislamg4/student_management_system_by_php/ and VulDB entry https://vuldb.com/vuln/367504 for any future maintainer response.