CVE-2026-86213: SQL Injection in Mstfakts College-Management-System

This vulnerability in Mstfakts College-Management-System allows remote attackers to perform SQL injection via manipulation of the book_name or book_author parameters in the Search Handler component (Front-end/university.php). The issue stems from unsafe use of the mysqli_query function without proper input validation or sanitization. The vulnerability is publicly known and exploitable, with a CVSS 4.0 base score of 6.9 (medium severity). Due to the rolling release model, no specific affected or patched versions are identified. The vendor has not yet provided a response or remediation.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS vector indicates low complexity and no privileges required, but with low confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation, parameterized queries, or web application firewalls to block malicious input targeting the book_name and book_author parameters until an official fix is available.