Skip to main content

Student-Management-System EUVDEUVD-2026-64623

| CVE-2026-78057 LOW
SQL Injection (CWE-89)
2026-08-23 VulDB GHSA-hxwh-q5c5-c67j
SQLi Student Management System
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network-reachable SQL injection requires low-privilege authentication; no scope change or material availability impact is supported by the description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Aug 23, 2026 - 03:29 vuln.today
Severity Changed
Aug 23, 2026 - 03:22 NVD
MEDIUM LOW
CVSS changed
Aug 23, 2026 - 03:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
CVE Published
Aug 23, 2026 - 02:45 cve.org
LOW 2.1

DescriptionCVE.org

A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown part of the component Management Mutation Handler. This manipulation of the argument roll_no/name/father_name/class/mobile/email/password/remark causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in sambitraj's Student-Management-System exposes multiple user-supplied parameters in the Management Mutation Handler to database query manipulation by authenticated remote attackers. The application uses a rolling release model with no versioned releases; all commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected and no patch has been issued despite responsible disclosure via GitHub issue. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege application credentials
Delivery
Authenticate to Student-Management-System
Exploit
Submit SQL payload in Management Mutation Handler parameter
Execution
Manipulate database query execution
Impact
Exfiltrate or modify student records
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid low-privilege authenticated session on the Student-Management-System web application, consistent with PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation with no user interaction required, but gated behind a low-privilege authentication requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a valid low-privilege account logs into the Student-Management-System and submits a crafted SQL payload (e.g., a UNION-based or boolean-blind injection string) into one of the vulnerable parameters such as roll_no or email within the Management Mutation Handler. A publicly available proof-of-concept at GitHub issue #5 demonstrates working injection payloads against the application. …
Remediation No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to disclosure and no fixed commit or release exists. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Student Management System

View all
CVE-2022-2876 CRITICAL POC
9.8 Aug 18

A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical
CVE-2020-23935 CRITICAL POC
9.8 Aug 20

Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (
CVE-2024-55270 HIGH POC
8.8 Feb 17

phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata
CVE-2024-6191 MEDIUM POC
6.9 Jun 20

A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severi
CVE-2024-5047 MEDIUM POC
6.9 May 17

A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium seve
CVE-2023-3008 CRITICAL
9.8 May 31

A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severi
CVE-2023-3007 CRITICAL
9.8 May 31

A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerab
CVE-2026-10777 MEDIUM POC
5.5 Jun 03

Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to rem
CVE-2026-10619 MEDIUM POC
5.5 Jun 02

Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthentic
CVE-2025-15034 MEDIUM POC
5.5 Dec 23

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands vi
CVE-2025-14967 MEDIUM POC
5.5 Dec 19

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via t
CVE-2025-14661 MEDIUM POC
5.5 Dec 14

SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

EUVD-2026-64623 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy