CVE-2026-11531

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11531", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-07T19:53:21.533Z", "datePublished": "2026-06-08T16:00:15.973Z", "dateUpdated": "2026-06-09T15:56:05.293Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-08T16:00:15.973Z"}, "title": "imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "imvks786", "product": "student_management_system", "versions": [{"version": "9599b560ad3c3b83e75d328b76bedcd489ef1f46", "status": "affected"}], "cpes": ["cpe:2.3:a:imvks786:student_management_system:*:*:*:*:*:*:*:*"], "modules": ["Administrator Login Endpoint"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This impacts an unknown function of the file admin/admin_login.php of the component Administrator Login Endpoint. Performing a manipulation of the argument a_usr/a_pwd results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-06-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-07T21:58:38.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Yeliuyun (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/369148", "name": "VDB-369148 | imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/369148/cti", "name": "VDB-369148 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11531", "name": "CVE-2026-11531 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/836633", "name": "Submit #836633 | imvks786 student_management_system 1.0 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/imvks786/student_management_system/issues/2", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/imvks786/student_management_system/", "tags": ["product"]}]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/836633", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T15:55:47.745756Z", "id": "CVE-2026-11531", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T15:56:05.293Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "Yeliuyun (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:imvks786:student_management_system:*:*:*:*:*:*:*:*"], "vendor": "imvks786", "modules": ["Administrator Login Endpoint"], "product": "student_management_system", "versions": [{"status": "affected", "version": "9599b560ad3c3b83e75d328b76bedcd489ef1f46"}]}], "timeline": [{"lang": "en", "time": "2026-06-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-07T21:58:38.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/369148", "name": "VDB-369148 | imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/369148/cti", "name": "VDB-369148 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11531", "name": "CVE-2026-11531 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/836633", "name": "Submit #836633 | imvks786 student_management_system 1.0 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/imvks786/student_management_system/issues/2", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/imvks786/student_management_system/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This impacts an unknown function of the file admin/admin_login.php of the component Administrator Login Endpoint. Performing a manipulation of the argument a_usr/a_pwd results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-08T16:00:15.973Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11531", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T15:55:47.745756Z"}}}], "references": [{"url": "https://vuldb.com/submit/836633", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-06-09T15:55:07.034Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-11531", "state": "PUBLISHED", "dateUpdated": "2026-06-08T16:00:15.973Z", "dateReserved": "2026-06-07T19:53:21.533Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-08T16:00:15.973Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:imvks786:student_management_system:*:*:*:*:*:*:*:*"], "modules": ["Administrator Login Endpoint"], "product": "student_management_system", "vendor": "imvks786", "versions": [{"status": "affected", "version": "9599b560ad3c3b83e75d328b76bedcd489ef1f46"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This impacts an unknown function of the file admin/admin_login.php of the component Administrator Login Endpoint. Performing a manipulation of the argument a_usr/a_pwd results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en el sistema de gesti\u00f3n de estudiantes imvks786 hasta 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Esto afecta una funci\u00f3n desconocida del archivo admin/admin_login.php del componente Punto Final de Inicio de Sesi\u00f3n del Administrador. Realizar una manipulaci\u00f3n del argumento a_usr/a_pwd resulta en inyecci\u00f3n SQL. El ataque puede ser llevado a cabo remotamente. El exploit ha sido publicado y puede ser utilizado para ataques. Este producto adopta una estrategia de lanzamiento continuo para mantener la entrega continua. Por lo tanto, los detalles de la versi\u00f3n para las versiones afectadas o actualizadas no pueden ser especificados. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencia pero a\u00fan no ha respondido."}], "id": "CVE-2026-11531", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11531", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T15:55:47.745756Z", "version": "2.0.3"}}]}, "published": "2026-06-08T17:16:40.200", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/imvks786/student_management_system/"}, {"source": "cna@vuldb.com", "url": "https://github.com/imvks786/student_management_system/issues/2"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-11531"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/836633"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369148"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369148/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://vuldb.com/submit/836633"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "9599b560ad3c3b83e75d328b76bedcd489ef1f46"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "student_management_system", "vendor": "imvks786"}], "created": "2026-06-08T19:00:14.088124+00:00", "updated": "2026-06-09T08:57:00.848181+00:00", "vendors": ["imvks786", "imvks786$PRODUCT$student_management_system"]}