sambitraj Student-Management-System SQL Injection

SQL injection in sambitraj's Student-Management-System exposes multiple user-supplied parameters in the Management Mutation Handler to database query manipulation by authenticated remote attackers. The application uses a rolling release model with no versioned releases; all commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected and no patch has been issued despite responsible disclosure via GitHub issue. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental), though no active exploitation has been confirmed and the CVSS 4.0 score of 2.1 reflects limited rated impact under low-privilege conditions.

SQL injection in the Dashboard component of sambitraj's Student-Management-System exposes the application to remote database manipulation via the roll_no and teacher_name parameters, affecting all commits through 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. A low-privileged authenticated attacker can inject arbitrary SQL to read or modify student records without any patch or vendor response currently available. A public exploit exists via GitHub issue disclosure, though real-world impact is constrained by the project's extremely narrow deployment footprint.