The vulnerability CVE-2026-9575 affects itsourcecode Student Transcript Processing System 1.0. It is caused by insufficient input validation of the 'ID' parameter in the specified PHP file, leading to SQL injection. This allows an unauthenticated remote attacker to inject malicious SQL commands, potentially impacting the confidentiality, integrity, and availability of the system's data. The vulnerability has been publicly disclosed but lacks an official fix or vendor advisory. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL injection vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the Student Transcript Processing System. The impact is rated medium based on the CVSS score of 6.9. There is no current evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'ID' parameter to prevent SQL injection. Restricting database permissions and employing web application firewalls may provide temporary mitigation. Monitor vendor channels for updates regarding an official patch or remediation.