CVE Intelligence
Analysis AI-assisted

CVE-2026-2018: itsourcecode School Management System 1.0 SQL Injection

A SQL injection flaw (CWE-89) has been reported in itsourcecode School Management System 1.0, where manipulating the ID argument can affect database queries. The record states the attack can be started remotely and that a published exploit exists, and NVD rates it 9.8 (CVSS 3.1, critical). The sources consulted show no KEV listing and no fixed version, so administrators should verify their installed version and restrict exposure.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2018 describes an SQL injection weakness (CWE-89) in itsourcecode School Management System 1.0. According to the record, the flaw is triggered by manipulating the ID argument in a file of the settings area, and the affected part of that file is not further specified.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which encodes network access, no privileges required, no user interaction and high impact on confidentiality, integrity and availability.
  • The CNA (cna@vuldb.com) lists additional scores of 7.3 (CVSS 3.1), 7.5 (CVSS 2.0) and 5.5 (CVSS 4.0).
  • Successful exploitation of a SQL injection can allow unauthorized reading or modification of database content. The actual impact depends on the database privileges and the deployment.

Affected products and versions

  • Product: itsourcecode School Management System.
  • Version listed in the record: 1.0.
  • Other versions: unknown. The record does not enumerate additional affected versions.
  • Fixed versions: none are listed in the record. This is unknown and does not confirm that no fix exists.

Exploitation status

  • The CISA KEV catalog entry for this CVE is not listed in the record, so no confirmed exploitation in the wild appears in the sources consulted.
  • The record states that an exploit has been published. A GitHub issue tagged as an exploit is cited among the references. This analysis does not reproduce any exploit material.
  • EPSS and SSVC data are not present in the record and are unknown.

Remediation and mitigation

  • Confirm whether your deployment runs version 1.0 and check with the vendor or developer for an updated release.
  • Until the status is verified, restrict access to administrative and settings functions, for example through network allowlists or a VPN.
  • Apply least-privilege principles to the database account used by the application.
  • Ask the developer to validate input and use parameterized queries in the affected code.
  • A web application firewall may serve as a temporary compensating control, but it does not replace a code fix.

Detection guidance

  • Review web server and application logs for unusual or malformed values in the ID parameter of settings-related requests.
  • Watch for database errors or unexpected query volume originating from web requests.
  • Alert on repeated requests from a single source against administrative endpoints.

Limitations of the available information

  • The record has no title, so the title in this analysis was assigned from the vendor, product and vulnerability class.
  • The affected component is described only generally, which limits precise scoping.
  • No fixed version, EPSS score or SSVC data is available in the record.
  • Scores differ across CVSS versions and providers, so the NVD 3.1 score is the primary reference used here.

Frequently asked questions

What is CVE-2026-2018?

It is an SQL injection weakness (CWE-89) reported in itsourcecode School Management System 1.0, triggered by manipulating the ID argument.

Is this vulnerability being actively exploited?

The record is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that an exploit has been published.

Which versions are affected and is there a fix?

The record lists version 1.0. No fixed version is listed, which is unknown rather than proof that no fix exists, so contact the vendor or developer to confirm.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.