PT-2026-30408 · Unknown · Halex Coursesel

Zyyyy · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5537

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions halex CourseSEL versions up to 1.1.0

Description A security issue exists in halex CourseSEL. The check sel function within the Apps/Index/Controller/IndexController.class.php file, specifically the HTTP GET Parameter Handler, is susceptible to SQL injection through manipulation of the seid parameter. This attack can be initiated remotely. The exploit has been publicly disclosed.

Recommendations Update to a version beyond 1.1.0.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-5537

Affected Products

Halex Coursesel

References · 7

• 🔥 https://github.com/zy606/Vulnerability-Report/tree/main/CourseSEL-SQLi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5537 · Security Note
• https://vuldb.com/vuln/355290/cti · Note
• https://vuldb.com/submit/782202 · Note
• https://twitter.com/CVEarity/status/2040792010823791077 · Twitter Post
• https://vuldb.com/vuln/355290 · Note
• https://twitter.com/cyberbivash/status/2040667557082865667 · Twitter Post