CVE-2026-11585 is a SQL injection vulnerability found in CodeAstro Student Attendance Management System 1.0. The flaw exists in an unknown function within the /attendance-php/Admin/createClassArms.php file, where the classId argument is improperly sanitized, enabling remote attackers to inject SQL commands. The vulnerability is remotely exploitable without user interaction and requires low privileges. Although publicly disclosed, there is no vendor-provided patch or official remediation guidance available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS score of 5.3 indicates a medium impact level, reflecting limited complexity and privileges required but with potential for partial data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality and validate or sanitize inputs on the classId parameter as a temporary mitigation.