CVE Intelligence
Analysis AI-assisted

CVE-2026-1590: itsourcecode School Management System SQL Injection

CVE-2026-1590 is an SQL injection weakness in the itsourcecode School Management System 1.0, triggered through manipulation of the ID argument in a faculty module page. The NVD assigns a CVSS 3.1 base score of 9.8 (Critical), and the CNA VulDB publishes additional scores under other CVSS versions. The record states that a public exploit is available, but it is not listed in CISA KEV and no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A SQL injection weakness has been reported in the itsourcecode School Management System 1.0. According to the CNA description, it affects an unidentified function in the file /ramonsys/faculty/index.php, and manipulating the ID argument leads to SQL injection that can be triggered remotely. Product information is available at itsourcecode.com and the VulDB entry is at vuldb.com.

Impact

SQL injection can allow a remote party who reaches the vulnerable function to influence database queries. Depending on the database permissions granted to the application, this could expose, change or delete stored data. The NVD base score is 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes high confidentiality, integrity and availability impact if the vector is accurate. The assigned weakness is CWE-74 (Injection), a broader category than SQL injection alone.

Affected products and versions

  • The description names itsourcecode School Management System 1.0.
  • The affected-product list names Angeljudesuarez School Management System, version 1.0.
  • The two product names differ, and the record does not explain the discrepancy. Confirm the vendor and component against your own inventory.
  • The record lists no other affected versions.

Exploitation status

The CNA description states that the exploit is publicly available and might be used. The record shows that the CVE is not listed in the CISA KEV catalog, so no active exploitation or exploitation in the wild is confirmed by the sources consulted. No EPSS score is present in the record.

Remediation and mitigation

  • The record does not identify a fixed version. This does not mean no fix exists; it means the record provides none.
  • The only fix-type entry in the record is labeled as mitigation and points to a third-party file-hosting link. That link was not reviewed and is not reproduced here.
  • Restrict access to the affected application to trusted networks until the owner confirms a corrective update.
  • Ask the vendor or maintainer for a patched release and validate it in a test environment before deployment.
  • If the code is maintained in-house, use parameterized queries and strict input validation on identifier parameters.
  • A web application firewall can serve as a temporary compensating control, but it does not replace a code fix.
  • Run the application with a database account that has the minimum privileges required.

Detection guidance

  • Review web server and application logs for unusual or malformed values in the ID parameter of faculty pages.
  • Watch for database error messages returned to clients, which can indicate probing activity.
  • Alert on request spikes to the faculty module from unfamiliar sources.
  • Retain logs for incident review and compare them against a known baseline of normal use.

Limitations of the available information

  • The record does not provide a vendor advisory, a patched version or a confirmed fix.
  • The product name in the affected list differs from the name in the description.
  • No EPSS or SSVC data is available.
  • The VulDB reference carries a Permissions Required tag, while the NVD vector indicates no privileges are required. This difference is unresolved.
  • The CNA scores use different CVSS versions and differ from the NVD score, so comparison requires care.

Frequently asked questions

Is this vulnerability being actively exploited?

The record does not list CVE-2026-1590 in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The CNA description says a public exploit is available, so the risk should be treated seriously.

What should administrators do now?

Restrict access to the application, seek a corrective update from the vendor or maintainer, and use parameterized queries if the code is maintained in-house. The record does not identify a fixed version.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.