CVE-2026-90514
HighCVSS 7.3Summary
A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.php. Such manipulation of the argument Status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
SQL injection may allow an attacker to read, modify, or delete database data, and in some cases execute code. The publicly available exploit increases the risk of rapid exploitation.
Recommendation
Apply a patch or upgrade the system if the vendor has provided a fix. In the meantime, implement input validation and parameterized SQL queries, and restrict access to the application to trusted networks.
Other vulnerabilities in School Registration and Fee System
See all- CVE-2026-90526High
A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0 in /bilal/save_class.php. Manipulation of the Category argument leads to SQL injection, allowing remote exploitation. The exploit has been publicly disclosed.
- CVE-2026-90516High
A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_report.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- CVE-2026-90515High
A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/delete_stud.php. Executing a manipulation of the argument selector[] can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Original NVD description (English source)
A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.php. Such manipulation of the argument Status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.