PT-2026-30408 · Halex · Coursesel

Zyyyy · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5537

Mitre

CVSS v3.1

6.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check sel of the file Apps/Index/Controller/IndexController.class.php of the component HTTP GET Parameter Handler. The manipulation of the argument seid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-5537

Affected Products

Coursesel

References · 6

• 🔥 https://github.com/zy606/Vulnerability-Report/tree/main/CourseSEL-SQLi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5537 · Security Note
• https://twitter.com/cyberbivash/status/2040667557082865667 · Twitter Post
• https://vuldb.com/vuln/355290 · Note
• https://vuldb.com/submit/782202 · Note
• https://vuldb.com/vuln/355290/cti · Note