CVE-2026-11582 is a SQL injection vulnerability affecting CodeAstro Student Attendance Management System 1.0. The flaw exists in an unspecified function in the /attendance-php/index.php file, where manipulation of the Username parameter allows an attacker to inject SQL commands. This vulnerability can be exploited remotely without any privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. No vendor-provided patch or official remediation is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score of 6.9. There are no confirmed reports of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Users of CodeAstro Student Attendance Management System 1.0 should monitor the vendor's advisories for updates. In the meantime, restricting access to the vulnerable endpoint and employing web application firewalls to detect and block SQL injection attempts may reduce risk.