PT-2026-6693 · Itsourcecode · Sourcecodester Student Management System

Tianrenu · Published 2026-02-06 · Updated 2026-02-11 · CVE-2026-2011

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0

Description A flaw exists in itsourcecode Student Management System that allows for remote SQL injection. The issue is located in the /ramonsys/enrollment/controller.php file, specifically through manipulation of the ID argument within an unknown function. The exploit for this issue has been publicly released.

Recommendations Apply any available updates or patches for itsourcecode Student Management System version 1.0. As a temporary workaround, restrict access to the /ramonsys/enrollment/controller.php file. Avoid using the ID parameter in the affected file until the issue is resolved.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-2011

Affected Products

Sourcecodester Student Management System

References · 10

• 🔥 https://github.com/tianrenu/CVE-Discoveries/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2026-2011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2011 · Security Note
• https://t.me/CVEtracker/43918 · Telegram Post
• https://twitter.com/cracbot/status/2021539760553230740 · Twitter Post
• https://itsourcecode.com · Note
• https://vuldb.com/?ctiid.344593 · Note
• https://vuldb.com/?id.344593 · Note
• https://vuldb.com/?submit.743498 · Note
• https://twitter.com/CVEnew/status/2019704899760693634 · Twitter Post