CVE-2026-9470
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SQL Injection vulnerability in student_trans.php of StudentManagementSystem (yashpokharna2555). Manipulation of FIRST_NAME/Last_Name/EMAIL arguments in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
Risk Assessment
Risk of remote SQL injection, potentially leading to data leakage and database integrity compromise.
Recommendation
Immediately implement parameterized SQL queries for FIRST_NAME/Last_Name/EMAIL arguments in student_trans.php.
Other vulnerabilities in StudentManagementSystem
See all- CVE-2026-9474High
SQL Injection vulnerability in /studentdel.php of StudentManagementSystem (yashpokharna2555). Manipulation of ID argument in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
- CVE-2026-9471Low
A cross-site scripting vulnerability was found in StudentManagementSystem (commit cb2f558d) in the /student.php file via the FIRST_NAME argument. Remote attack is possible. Exploit is publicly available. The project has not responded.
- CVE-2026-9469High
SQL Injection vulnerability in /success.php of StudentManagementSystem (yashpokharna2555). Manipulation of User argument in an unknown function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
- CVE-2026-9438Medium
In the StudentManagementSystem project (commit cb2f558d), a vulnerability exists in courseDel.php. Manipulation of the ID argument leads to improper control of resource identifiers, enabling remote attack. The exploit has been published.
Original NVD description (English source)
A security vulnerability has been detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This affects the function confirm_logged_in of the file student_trans.php. Such manipulation of the argument FIRST_NAME/Last_Name/EMAIL leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.