PT-2026-33690 · Unknown · Projectsandprograms School Management System

Ethx0 · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6595

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProjectsAndPrograms School Management System versions prior to 6b6fae5426044f89c08d0dd101c7fa71f9042a59

Description An issue exists in the HTTP GET Parameter Handler component within the 'buslocation.php' file. Remote attackers can perform SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution, by manipulating the bus id argument.

Recommendations Update ProjectsAndPrograms School Management System to a version later than 6b6fae5426044f89c08d0dd101c7fa71f9042a59. As a temporary workaround, restrict access to the 'buslocation.php' file or avoid using the bus id parameter until a patch is applied.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-6595

Affected Products

Projectsandprograms School Management System

References · 6

• 🔥 https://tcn60zf28jhk.feishu.cn/wiki/MdHFw78Gmi1zbske8Ozc6XTjnIh?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6595 · Security Note
• https://vuldb.com/submit/791820 · Note
• https://vuldb.com/vuln/358230 · Note
• https://twitter.com/VulmonFeeds/status/2046077729922011641 · Twitter Post
• https://vuldb.com/vuln/358230/cti · Note