PT-2026-25707

CVE-2026-4238

Publicado

2026-03-16

Atualizado

2026-03-17

Descrição por

CVSS 2.0

5.8

Média

MétricasAV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions itsourcecode College Management System version 1.0

Description A flaw exists in the processing of files within the application. Specifically, the /admin/courses.php file is susceptible to SQL injection due to improper handling of the course code parameter. This allows for remote exploitation. The details of the exploit have been publicly disclosed.

Recommendations Apply a fix to address the improper handling of the course code parameter in the /admin/courses.php file.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Zzh01007

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')