CVE-2026-86268: SQL Injection in itsourcecode School Management System

The vulnerability CVE-2026-86268 affects itsourcecode School Management System version 1.0. It is a SQL injection flaw in an unknown function of the User_Login.php file, triggered by manipulation of the email parameter. This allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the database. The exploit is publicly known, increasing the risk of exploitation. No patch or remediation information is provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database impacts depending on the database permissions and structure. The vulnerability is remotely exploitable without authentication, increasing its risk. However, no specific impact details beyond the injection vector are provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the email parameter in User_Login.php.