CVE-2026-111993 Details
Description
A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in Soarkey StudentManagement versions prior to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e, where user passwords are stored, compared, and disclosed in plaintext. This issue is present in the UserDao.login function within the AdminDao.java file. The vulnerability allows for the local execution of an attack that exploits the unprotected password storage, leading to the exposure of sensitive information.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Soarkey/StudentManagement/ | [email protected] | ProductVendor |
| https://github.com/Soarkey/StudentManagement/issues/36 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-111993 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1008019 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421658 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421658/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-310 | Cryptographic Issues | [email protected] |
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Soarkey StudentManagement | <e08f7f1d5015af407aa4cca0ada3dea189b4937e |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |