CVE-2026-9474
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SQL Injection vulnerability in /studentdel.php of StudentManagementSystem (yashpokharna2555). Manipulation of ID argument in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
Risk Assessment
Risk of remote SQL injection, potentially leading to data leakage and database integrity compromise.
Recommendation
Immediately implement parameterized SQL queries for the ID argument in /studentdel.php.
Other vulnerabilities in StudentManagementSystem
See all- CVE-2026-9471Low
A cross-site scripting vulnerability was found in StudentManagementSystem (commit cb2f558d) in the /student.php file via the FIRST_NAME argument. Remote attack is possible. Exploit is publicly available. The project has not responded.
- CVE-2026-9470High
SQL Injection vulnerability in student_trans.php of StudentManagementSystem (yashpokharna2555). Manipulation of FIRST_NAME/Last_Name/EMAIL arguments in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
- CVE-2026-9469High
SQL Injection vulnerability in /success.php of StudentManagementSystem (yashpokharna2555). Manipulation of User argument in an unknown function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
- CVE-2026-9438Medium
In the StudentManagementSystem project (commit cb2f558d), a vulnerability exists in courseDel.php. Manipulation of the ID argument leads to improper control of resource identifiers, enabling remote attack. The exploit has been published.
Original NVD description (English source)
A vulnerability was found in yashpokharna2555 StudentManagementSystem up to cb2f558ddf8d19396de0f92abf2d224d46a0a203. Affected by this issue is the function confirm_logged_in of the file /studentdel.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.