CVE Intelligence
Analysis AI-assisted

CVE-2026-1545: itsourcecode School Management System SQL Injection in /course/index.php

CVE-2026-1545 is a SQL injection weakness reported in itsourcecode School Management System 1.0, in the file /course/index.php. The record states that it can be exploited remotely and that a public exploit is available, and NVD rates it 9.8 under CVSS 3.1. The record lists no fixed version, only a mitigation reference, and the CISA KEV catalog does not list it.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-1545 is a SQL injection weakness reported in itsourcecode School Management System 1.0, affecting an unspecified function in /course/index.php where the ID argument is involved. The CVE was published on 2026-01-28 and the CNA is VulDB. NVD scores it 9.8 under CVSS 3.1.

Impact

  • The record states that successful manipulation of the ID argument can lead to SQL injection.
  • The NVD CVSS 3.1 vector describes a network attack requiring no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • The assigned CWE is CWE-74 (Injection), while the description specifically refers to SQL injection.

Affected products and versions

  • The description names itsourcecode School Management System 1.0.
  • The structured affected-product field names Angeljudesuarez School Management System, version 1.0.
  • These product names do not match, so the correct vendor and product attribution cannot be confirmed from the record.

Exploitation status

  • The record states that an exploit has been made available to the public.
  • The CVE is not listed in CISA KEV in the data consulted, so no confirmed active exploitation is reported in the sources consulted.

Remediation and mitigation

  • No fixed version is listed. The only fix entry is a mitigation reference to a third-party issue tracker.
  • Organizations using this software should check with the vendor or maintainer for an updated release and review the mitigation guidance in the referenced issue.
  • While no fix is confirmed, consider restricting network exposure of the application, limiting access to administrative and course-management functions, and reviewing whether input handling in the affected file uses parameterized queries.

Detection guidance

  • Review web server and application logs for unusual requests to /course/index.php with abnormal values in the ID parameter.
  • Monitor database errors and unexpected query behavior originating from the application.
  • Consider web application monitoring rules at a high level, and test them before deployment to avoid false positives.

Limitations of the available information

  • No fixed version is provided in the record.
  • Vendor and product naming is inconsistent between the description and the affected-product field.
  • CVSS scores differ by provider: NVD 3.1 score 9.8; VulDB 4.0 score 5.5, 3.1 score 7.3, and 2.0 score 7.5.
  • EPSS and SSVC data are absent, and KEV status is recorded as not listed.

Frequently asked questions

What is CVE-2026-1545?

It is a SQL injection weakness reported in itsourcecode School Management System 1.0, in the file /course/index.php, according to the record.

Is this vulnerability being actively exploited?

The record says a public exploit is available, but this CVE is not listed in the CISA KEV catalog in the data consulted, so no confirmed active exploitation appears in the sources consulted.

Is there a fixed version?

The record does not list a fixed version. It only includes a mitigation reference, so administrators should check with the vendor or maintainer for an update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.