CVE-2026-10111

A vulnerability was detected in sambitraj Student-Management-System. Unknown functionality of the Dashboard component allows manipulation of roll_no/teacher_name arguments, leading to SQL injection. The attack can be executed remotely, and the exploit is now public.

In the Student-Management-System (commit 18ea7904...), an SQL injection vulnerability was detected in loginCheckTest.php in the Login component. Manipulation of the username/password arguments allows remote attack. The exploit is public, and the product does not use versioning, so no information about affected versions is available.

A vulnerability in imranrisal-dev Student-Management-System allows unrestricted file upload via the storeProfileImage function in student_profile_pic.php. An attacker can remotely manipulate the choose_file argument to upload arbitrary files. The exploit has been publicly disclosed and may be utilized.

A weakness has been identified in imvks786 student_management_system up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46. An unknown function in the file /add.php of the Student Record Handler component is affected. Executing a manipulation can lead to improper access controls. The attack may be performed remotely. The exploit has been made public and could be used for attacks. The project uses a rolling release system, so version information is not disclosed. The project was informed but has not responded.

An improper authorization vulnerability was detected in Kushan2k student-management-system up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a in the edit-admin function of controllers/AdminController.php in the Profile Update Endpoint component via manipulation of the isadmin argument. The attack can be carried out remotely, and the exploit has been publicly disclosed. The product follows a rolling release model, so no version is provided.

Kushan2k student-management-system up to commit f16a4ce has an unrestricted file upload vulnerability in service/RegisterService.php via the stimg argument. The attack can be performed remotely, and the exploit is publicly available. The project has not responded.

Student-Management-System up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0 has a vulnerability in admin/deleteform.php where the sid argument leads to improper authorization.

Vulnerability in Student-Management-System (a4m4) up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0. An unknown function in admin/ allows execution after redirect (open redirect). Remote attack possible.

A cross-site scripting vulnerability was found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 on the Dashboard page. Manipulating the Name argument allows remote script execution. The exploit is public, and the project has not responded.

Vulnerability in STUDENT-MANAGEMENT-SYSTEM (up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5) in the Dashboard component, leading to improper access controls. The attack can be performed remotely, and the exploit is publicly available.