CVE-2026-11584: SQL Injection in CodeAstro Student Attendance Management System
CVE-2026-11584 is a medium severity SQL injection vulnerability found in CodeAstro Student Attendance Management System version 1. 0. The issue occurs in the /attendance-php/Admin/createClass. php file when the 'ID' parameter is manipulated during an edit action. This vulnerability allows remote attackers to inject SQL commands. Although the exploit code has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.
AI Analysis
Technical Summary
The vulnerability CVE-2026-11584 affects CodeAstro Student Attendance Management System 1.0. It is an SQL injection flaw in the /attendance-php/Admin/createClass.php script, specifically when handling the 'ID' parameter during an edit action. This allows an attacker to remotely inject SQL queries, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vulnerability was published on June 8, 2026, with no vendor patch or mitigation details available.
Potential Impact
Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the affected system. This may lead to unauthorized data access or modification. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. There are no known active exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'ID' parameter in the edit action of createClass.php. Monitor vendor channels for updates and apply patches promptly once available.
CVE-2026-11584: SQL Injection in CodeAstro Student Attendance Management System
Description
CVE-2026-11584 is a medium severity SQL injection vulnerability found in CodeAstro Student Attendance Management System version 1. 0. The issue occurs in the /attendance-php/Admin/createClass. php file when the 'ID' parameter is manipulated during an edit action. This vulnerability allows remote attackers to inject SQL commands. Although the exploit code has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVSS v4.0
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-11584 affects CodeAstro Student Attendance Management System 1.0. It is an SQL injection flaw in the /attendance-php/Admin/createClass.php script, specifically when handling the 'ID' parameter during an edit action. This allows an attacker to remotely inject SQL queries, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vulnerability was published on June 8, 2026, with no vendor patch or mitigation details available.
Potential Impact
Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the affected system. This may lead to unauthorized data access or modification. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. There are no known active exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'ID' parameter in the edit action of createClass.php. Monitor vendor channels for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-08T12:05:37.005Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a271c94e29bf47b5081f5a3
Added to database: 6/8/2026, 7:48:36 PM
Last enriched: 6/8/2026, 7:52:26 PM
Last updated: 6/8/2026, 9:03:37 PM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.