CVE Intelligence
Analysis AI-assisted

CVE-2026-2011: Itsourcecode Student Management System SQL Injection

CVE-2026-2011 is an SQL injection (CWE-89) in itsourcecode Student Management System version 1.0, triggered by manipulation of the ID argument and reachable remotely. NVD scores it 9.8 under CVSS 3.1, and the description states that a public exploit exists. The record shows no fixed version and no KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2011 describes an SQL injection (CWE-89) in itsourcecode Student Management System version 1.0. According to the record, manipulating the ID argument handled by an unknown function in an enrollment controller file results in SQL injection, and the attack can be launched remotely.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • The CNA VulDB also lists 7.3 under CVSS 3.1, 5.5 under CVSS 4.0 and 7.5 under CVSS 2.0.
  • The specific data exposed depends on the deployment and is not stated in the record.

Affected products and versions

  • Product named in the description: itsourcecode Student Management System 1.0.
  • Product named in the affected field: Itsourcecode School Management System, version 1.0. The naming difference should be verified against the vendor site.
  • No fixed version is listed in the record.

Exploitation status

  • The description states that the exploit has been made public and could be used. A reference tagged as Exploit points to a public issue entry.
  • This CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • The record documents no vendor fix. Administrators should check the vendor site and request an updated release.
  • Until a fix is confirmed, restrict network exposure of the application, limit access to administrative and enrollment functions, and verify whether the instance is internet-facing.
  • If the application is customized in-house, apply strict input validation and parameterized queries in the affected code path.

Detection guidance

  • Review web server and application logs for abnormal or malformed values in the ID parameter on enrollment-related pages.
  • Monitor database error responses returned to clients and unexpected query behavior from the application database account.
  • Web application firewall alerts for SQL-related patterns can add visibility, but they do not replace a code fix.

Limitations of the available information

  • The record does not identify a fixed version, a vendor advisory or the exact vulnerable function.
  • EPSS and SSVC data are not available in the record.
  • The product name differs between the description and the affected field.

Frequently asked questions

Is CVE-2026-2011 being actively exploited?

The record does not list this CVE in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The description does state that a public exploit exists and could be used.

What is the severity of CVE-2026-2011?

NVD assigns a CVSS 3.1 base score of 9.8, rated Critical, with a network attack vector and no privileges or user interaction required. The CNA VulDB lists lower scores under other CVSS versions.

Is there a fixed version available?

The record does not list any fixed version or vendor patch. Users should check the vendor site and request an updated release before assuming a fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.