CVE-2026-9469
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SQL Injection vulnerability in /success.php of StudentManagementSystem (yashpokharna2555). Manipulation of User argument in an unknown function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
Risk Assessment
Risk of remote SQL injection, potentially leading to data leakage and database integrity compromise.
Recommendation
Immediately implement parameterized SQL queries for the User argument in /success.php.
Other vulnerabilities in StudentManagementSystem
See all- CVE-2026-9474High
SQL Injection vulnerability in /studentdel.php of StudentManagementSystem (yashpokharna2555). Manipulation of ID argument in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
- CVE-2026-9471Low
A cross-site scripting vulnerability was found in StudentManagementSystem (commit cb2f558d) in the /student.php file via the FIRST_NAME argument. Remote attack is possible. Exploit is publicly available. The project has not responded.
- CVE-2026-9470High
SQL Injection vulnerability in student_trans.php of StudentManagementSystem (yashpokharna2555). Manipulation of FIRST_NAME/Last_Name/EMAIL arguments in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
- CVE-2026-9438Medium
In the StudentManagementSystem project (commit cb2f558d), a vulnerability exists in courseDel.php. Manipulation of the ID argument leads to improper control of resource identifiers, enabling remote attack. The exploit has been published.
Original NVD description (English source)
A weakness has been identified in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. The impacted element is an unknown function of the file /success.php. This manipulation of the argument User causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.