CVE-2026-78057: SQL Injection in sambitraj Student-Management-System

This vulnerability in sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 allows remote attackers to perform SQL injection via manipulation of input arguments including roll_no, name, father_name, class, mobile, email, password, and remark in the Management Mutation Handler component. The product's rolling release model prevents precise version identification. The issue was reported early but remains unpatched. Exploit code is publicly available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges. The CVSS 4.0 score of 5.3 reflects a medium impact with limited confidentiality, integrity, and availability impact.

No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's project for updates and consider applying any future patches promptly. Until a fix is released, restricting access to the affected component and validating or sanitizing inputs may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.