CVE-2026-119619

HighCVSS 7.3

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

A vulnerability was found in cak-filemanagement-system in the mysqli_query function of admin/save_student.php. Manipulating the date/department/subject/forwarded_to/action_taken_by/section/password arguments results in SQL injection, and the attack can be carried out remotely. The exploit has been made public and could be used.

Risk Assessment

An attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The public exploit increases the risk of rapid exploitation.

Recommendation

Update the system to a patched version as soon as possible or restrict access to admin/save_student.php. In the meantime, enforce input validation and monitor for unusual SQL queries.

Other vulnerabilities in cak-filemanagement-system

CVE-2026-119620High
A vulnerability was found in cak-filemanagement-system in the move_uploaded_file function of admin/add_logs.php. Manipulating the File argument allows unrestricted file upload, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.

Original NVD description (English source)

A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS