A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. (CVE-2026-111993)
Description
A flaw in Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e affects the UserDao.login function in AdminDao.java. This vulnerability involves manipulation of the Password argument causing cleartext storage of sensitive information. Exploitation requires local access. The issue was reported early to the project, but no response or fix has been issued yet. The vulnerability has a low CVSS score of 3.3 and no known active exploitation in the wild.
CVSS v3.1
Score 3.3low
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Soarkey StudentManagement affects the UserDao.login function within the AdminDao.java source file. It allows an attacker with local access to manipulate the Password argument, resulting in the cleartext storage of sensitive information. This flaw compromises confidentiality but does not impact integrity or availability. The project was notified early but has not provided a fix or response. Exploit code has been published, but no known in-the-wild exploitation has been reported.
Potential Impact
The vulnerability leads to the cleartext storage of sensitive password information, which could allow an attacker with local access to obtain confidential credentials. The impact is limited to confidentiality loss with no direct effect on integrity or availability. Since exploitation requires local privileges, the risk is lower compared to remote vulnerabilities.
Mitigation Recommendations
No official fix or patch is currently available as the project has not responded to the issue report. Users should restrict local access to trusted personnel only and monitor for any suspicious activity. Patch status is not yet confirmed — check the vendor advisory or project repository for updates on remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xc6q-w9mr-9c5p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-111993"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad520a82cdf04f656993881
Added to database: 10/18/2026, 19:40:24 UTC
Last enriched: 10/18/2026, 22:15:08 UTC
Last updated: 10/19/2026, 01:48:08 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.