PT-2026-45270 · Unknown · Student Management System By Php

Buerchen · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-10226

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions raisulislamg4 student management system by php versions prior to 310d950e09013d5133c6b9210aff9444382d16d1

Description A remote SQL injection can occur due to a flaw in an unknown function within the 'delete.php' file. This issue is triggered by manipulating the user id, course id, teacher id, student id, or application id arguments. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to interfere with the database.

Recommendations Update to a version later than 310d950e09013d5133c6b9210aff9444382d16d1. As a temporary workaround, restrict access to the 'delete.php' file or avoid using the user id, course id, teacher id, student id, and application id parameters until a fix is applied.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-10226

Affected Products

Student Management System By Php

References · 9

• 🔥 https://github.com/raisulislamg4/student_management_system_by_php/issues/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10226 · Security Note
• https://t.me/cveNotify/165418 · Telegram Post
• https://vuldb.com/vuln/367505/cti · Note
• https://vuldb.com/vuln/367505 · Note
• https://vuldb.com/submit/822786 · Note
• https://vuldb.com/cve/CVE-2026-10226 · Note
• https://t.me/CVEtracker/55444 · Telegram Post
• https://github.com/raisulislamg4/student_management_system_by_php · Note