CVE-2026-10226 Details
Description
A flaw has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. Impacted is an unknown function of the file delete.php. Executing a manipulation of the argument user_id/course_id/teacher_id/student_id/application_id can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
A SQL injection vulnerability has been identified in the Raisulislamg4 Student Management System, specifically in the delete.php file, within versions prior to the latest commit on November 1, 2023. The vulnerability arises from an unknown function that allows for SQL injection through manipulation of the user_id, course_id, teacher_id, student_id, or application_id parameters. This issue can be exploited remotely, as the delete.php script lacks authentication and authorization checks, enabling unauthenticated users to delete various records such as users, courses, teachers, students, and applications. The SQL injection occurs because the SQL queries are constructed by directly concatenating unsanitized GET values, creating an opportunity for attackers to manipulate the SQL query and potentially execute arbitrary SQL commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 1, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/raisulislamg4/student_management_system_by_php/ | [email protected] | Source CodeVendor |
| https://github.com/raisulislamg4/student_management_system_by_php/issues/3 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-10226 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/822786 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/367505 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/367505/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| raisulislamg4 student_management_system_by_php | <= 310d950e09013d5133c6b9210aff9444382d16d1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |