Description
A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Published: 2026-09-07
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the User_Login.php file of version 1.0 of itsourcecode School Management System. An attacker can send a crafted email argument that is not properly sanitized, allowing arbitrary SQL code to be executed against the backend database. This flaw corresponds to CWE-74 and CWE-89 and is reported as a remote SQL injection capability.

Affected Systems

The affected system is the itsourcecode School Management System version 1.0, specifically the User_Login.php component used for user authentication.

Risk and Exploitability

The CVSS base score of 6.9 indicates a moderate severity and the vulnerability is publicly disclosed. No EPSS data is available, so the precise exploitation probability is unknown, and the issue is not listed in CISA KEV. The attack vector is remote, with the payload entering through the email field; any exposed instance of the application is therefore at risk and prompt remediation is advised.

Generated by OpenCVE AI on September 7, 2026 at 05:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest release of itsourcecode School Management System that addresses the SQL injection in User_Login.php.
  • If an update is not immediately available, restrict remote access to the login endpoint and enforce input validation on the email field to prevent injection.
  • Enable web application firewall rules to block suspicious SQL payload patterns.

Generated by OpenCVE AI on September 7, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Title itsourcecode School Management System User_Login.php sql injection
First Time appeared Itsourcecode
Itsourcecode school Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:school_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode school Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode School Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-07T03:45:08.394Z

Reserved: 2026-09-06T12:30:48.221Z

Link: CVE-2026-86268

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T04:17:55.277

Modified: 2026-09-07T04:17:55.277

Link: CVE-2026-86268

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T05:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')