CVE-2026-9474: SQL Injection in yashpokharna2555 StudentManagementSystem
CVE-2026-9474 is a medium severity SQL injection vulnerability in the yashpokharna2555 StudentManagementSystem affecting the confirm_logged_in function in /studentdel.php. The vulnerability arises from improper handling of the ID argument, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so no specific version details beyond the affected commit hash are available. The issue was reported early but the vendor has not responded or issued a fix yet. Exploit code has been made public, increasing the risk of exploitation.
AI Analysis
Technical Summary
This vulnerability involves SQL injection in the confirm_logged_in function of the /studentdel.php file within the yashpokharna2555 StudentManagementSystem. Manipulation of the ID parameter allows an attacker to inject SQL queries remotely. The product is delivered via a rolling release process, so no discrete affected or patched versions exist. The vendor has been notified but has not provided a response or patch. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Public exploit code is available, but no known exploitation in the wild has been reported.
Potential Impact
Successful exploitation could allow a remote attacker to execute arbitrary SQL commands on the backend database via the ID parameter in the confirm_logged_in function. This could lead to unauthorized data access or modification. The impact is rated medium based on CVSS 4.0 scoring. There is no evidence of active exploitation in the wild at this time.
Mitigation Recommendations
No official fix or patch has been released by the vendor as of the latest information. Since the vendor has not responded and no remediation level or patch links are provided, patch status is not yet confirmed—check the vendor advisory or project repository for updates. Until a fix is available, users should consider implementing input validation or parameterized queries as a temporary mitigation if possible. Monitor for vendor updates regarding an official fix.
CVE-2026-9474: SQL Injection in yashpokharna2555 StudentManagementSystem
Description
CVE-2026-9474 is a medium severity SQL injection vulnerability in the yashpokharna2555 StudentManagementSystem affecting the confirm_logged_in function in /studentdel.php. The vulnerability arises from improper handling of the ID argument, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so no specific version details beyond the affected commit hash are available. The issue was reported early but the vendor has not responded or issued a fix yet. Exploit code has been made public, increasing the risk of exploitation.
CVSS v4.0
Score 6.9medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves SQL injection in the confirm_logged_in function of the /studentdel.php file within the yashpokharna2555 StudentManagementSystem. Manipulation of the ID parameter allows an attacker to inject SQL queries remotely. The product is delivered via a rolling release process, so no discrete affected or patched versions exist. The vendor has been notified but has not provided a response or patch. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Public exploit code is available, but no known exploitation in the wild has been reported.
Potential Impact
Successful exploitation could allow a remote attacker to execute arbitrary SQL commands on the backend database via the ID parameter in the confirm_logged_in function. This could lead to unauthorized data access or modification. The impact is rated medium based on CVSS 4.0 scoring. There is no evidence of active exploitation in the wild at this time.
Mitigation Recommendations
No official fix or patch has been released by the vendor as of the latest information. Since the vendor has not responded and no remediation level or patch links are provided, patch status is not yet confirmed—check the vendor advisory or project repository for updates. Until a fix is available, users should consider implementing input validation or parameterized queries as a temporary mitigation if possible. Monitor for vendor updates regarding an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-24T09:12:31.911Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1485eca5ae1af1aacc71bc
Added to database: 05/25/2026, 17:25:00 UTC
Last enriched: 06/01/2026, 21:02:29 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.