CVE-2026-12175 is a SQL injection vulnerability in CodeAstro Student Attendance Management System 1.0. The issue is located in an unspecified function within /attendance-php/Admin/createStudents.php, where the admissionNumber parameter is not properly sanitized. This allows remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity) with network attack vector, low complexity, no privileges required but requiring high privileges to exploit, and limited confidentiality, integrity, and availability impact. There is no vendor-provided patch or official remediation information at this time.

Successful exploitation of this vulnerability could allow an attacker with high privileges to perform SQL injection attacks remotely by manipulating the admissionNumber parameter. This may lead to unauthorized access or modification of the database contents. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable functionality to trusted administrators only and monitor for suspicious activity related to the admissionNumber parameter. Avoid exposing the affected endpoint to untrusted networks if possible.