CVE-2026-90526
HighCVSS 7.3Summary
A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0 in /bilal/save_class.php. Manipulation of the Category argument leads to SQL injection, allowing remote exploitation. The exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely execute arbitrary SQL queries, potentially leading to data leakage, database modification, or system compromise. The vulnerability is easy to exploit.
Recommendation
Immediately implement parameterized queries or input filtering in save_class.php. Update to the latest version if available.
Other vulnerabilities in School Registration and Fee System
See all- CVE-2026-90516High
A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_report.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- CVE-2026-90515High
A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/delete_stud.php. Executing a manipulation of the argument selector[] can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-90514High
A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.php. Such manipulation of the argument Status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.