CVE-2026-5537
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A SQL injection vulnerability was found in halex CourseSEL up to version 1.1.0 in the check_sel function of IndexController.class.php. Manipulation of the seid argument via HTTP GET allows remote attack. The exploit has been disclosed, and the vendor did not respond.
Risk Assessment
An attacker can remotely manipulate the database, potentially leading to data leakage or modification.
Recommendation
Immediately disable or replace the vulnerable component, as the vendor has not provided patches.
Original NVD description (English source)
A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the file Apps/Index/Controller/IndexController.class.php of the component HTTP GET Parameter Handler. The manipulation of the argument seid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.