Is there a public PoC exploit available for EUVD-2026-53020?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53020. Prioritise patching immediately. EPSS: 0.2%.

Student Registration System EUVD-2026-53020

Q: What is the CVSS score of EUVD-2026-53020?

EUVD-2026-53020 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-18896 LOW

SQL Injection (CWE-89)

2026-08-05 VulDB

GHSA-5h56-28xw-5746

PHP SQLi Student Registration System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

PR:L reflects the required authenticated student session; S:U and C/I/A:L reflect bounded database-level impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 02:28 vuln.today

Severity Changed

Aug 05, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Aug 05, 2026 - 02:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Aug 05, 2026 - 01:45 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in lavkush-maurya Student-Registration-System 1.0 allows authenticated remote attackers to manipulate backend database queries via the unsanitized oldpass parameter in /student/changepass.php, potentially exposing or modifying student records. A proof-of-concept exploit has been publicly disclosed on GitHub, making exploitation trivial for any holder of a low-privileged student account. No vendor patch exists - the maintainer did not respond to coordinated disclosure - leaving all deployments of this version permanently unmitigated absent manual intervention.

Technical ContextAI

The affected product is a PHP-based web application for student registration, identified by CPE cpe:2.3:a:lavkush-maurya:student-registration-system:*:*:*:*:*:*:*:*. The flaw is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a root cause arising from passing user-supplied input directly into a database query without parameterization or escaping. Specifically, the oldpass argument in the password change handler (/student/changepass.php) is concatenated into a SQL statement, allowing classical injection techniques such as time-based blind or boolean-based inference attacks, as demonstrated in the referenced GitHub POC. The wildcard version in the CPE string suggests the entire codebase may be affected rather than a specific patched-then-regressed release.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer did not respond to coordinated disclosure, and no fixed version is confirmed in the referenced materials. Operators running this application should immediately apply a web server-level access restriction to /student/changepass.php (e.g., via .htaccess deny rules or an nginx location block), accepting the operational trade-off that students will be unable to change their own passwords via the interface. The correct long-term fix requires replacing unsanitized oldpass concatenation in the PHP source with parameterized prepared statements using PDO or MySQLi; forks or self-hosted copies can apply this fix directly. If the application is internet-facing, consider taking it offline entirely until remediated, as any authenticated student can exploit this endpoint. The public POC is documented at https://github.com/sudaisnazir2381-lang/Student-Registration-System/blob/main/sql_injection_time.md and the VulDB entry is at https://vuldb.com/vuln/385931.