Which versions of Student Management System are affected by EUVD-2026-33560?

Organizations deploying the PHP-based Student Management System face immediate exposure of student records and credentials to unauthenticated remote attackers.

Is there a public PoC exploit available for EUVD-2026-33560?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33560. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-33560?

Within 24 hours: identify all systems running the Student Management System and characterize the scope of student data at risk; immediately restrict external network access or take the application offline if operationally feasible. Within 7 days: if the system must remain operational, implement Web Application Firewall rules blocking SQL injection patterns in the affected add_user_check.php parameters, enable comprehensive database audit logging, and isolate the system on a segregated network. Within 30 days: migrate to an actively maintained alternative Student Management System or confirm that the upstream project has released a security patch; if neither is available, engage qualified security consultants for deeper compensating controls.

Student Management System EUVD-2026-33560

Q: What is the CVSS score of EUVD-2026-33560?

EUVD-2026-33560 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10227 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-78q3-5772-2f6r

PHP SQLi Student Management System By Php Raisulislamg4

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 06:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 06:20 vuln.today

DescriptionCVE.org

A vulnerability has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. The affected element is an unknown function of the file add_user_check.php of the component User Creation Handler. The manipulation of the argument role leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in raisulislamg4's PHP-based Student Management System allows remote unauthenticated attackers to manipulate the 'role' parameter in add_user_check.php to inject arbitrary SQL queries. Publicly available exploit code exists per VulDB disclosure, and the project (a rolling-release GitHub repository) has not responded to the reporter's issue, leaving deployments unpatched. CVSS 7.3 with low complexity and no privileges required makes this an attractive low-effort target despite the limited deployment footprint of this open-source educational project.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in the User Creation Handler component (add_user_check.php). The affected codebase is a PHP-based student management application by GitHub user raisulislamg4, identified by CPE cpe:2.3:a:raisulislamg4:student_management_system_by_php. SQL injection in this context typically arises from concatenating user-supplied POST/GET parameters directly into SQL statements without prepared statements or parameterized queries - here the 'role' argument from a user-creation form is inlined into a query against the user database, allowing an attacker to break out of the intended string context and append arbitrary SQL.

RemediationAI

No vendor-released patch identified at time of analysis - the maintainer was notified via GitHub issue #4 but has not responded. Operators should immediately replace the vulnerable SQL construction in add_user_check.php with parameterized queries using PDO prepared statements or mysqli_prepare with bound parameters for the 'role' argument and any other user-controlled inputs in that handler, and audit sibling handlers for the same pattern. Until a self-patched build is deployed, compensating controls include restricting the user-creation endpoint to authenticated administrative sessions via a front-end web server rule (trade-off: breaks intended self-registration flows if used), placing a WAF such as ModSecurity with the OWASP CRS in front of the application to block SQLi payloads (trade-off: signature-based, can be bypassed by encoding/obfuscation), and applying least-privilege to the application's database account so that even successful injection cannot DROP tables or read other databases (trade-off: requires schema/account refactoring). Track upstream at https://github.com/raisulislamg4/student_management_system_by_php/issues/4 and the VulDB entry at https://vuldb.com/vuln/367506 for any forthcoming fix.