CVE-2026-10227: high vulnerability (CVSS 7.3)
CVE-2026-10227 affects raisulislamg4's student_management_system_by_php, allowing SQL injection via the 'role' parameter in add_user_check.php. Remote exploitation is possible, and a public exploit exists. The project has been informed but remains unresponsive.
Admins should immediately restrict access to the User Creation Handler and deploy web application firewalls (WAFs) to mitigate SQL injection attempts. Consider migrating to a more actively maintained platform if updates remain unavailable.
CVE-2026-10227 is a high-severity vulnerability (CVSS 7.3) impacting the raisulislamg4 student_management_system_by_php. The flaw resides in the add_user_check.php file's User Creation Handler component, where improper sanitization of the 'role' parameter enables SQL injection.
The vulnerability allows remote attackers to exploit the system, potentially compromising sensitive data or gaining unauthorized access. A public exploit has been disclosed, increasing the urgency for remediation.
Despite early notification to the project via issue reporting, there has been no response or patch release. Users should implement immediate defensive measures, such as input validation, WAFs, and limiting system exposure to untrusted sources.