PT-2026-22831

CVE-2026-3487

Published

2026-03-03

Updated

2026-03-05

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions itsourcecode College Management System version 1.0

Description A SQL injection issue exists due to the manipulation of the course code argument within the processing of the /admin/class-result.php file. This allows for remote attacks. The exploit for this issue has been publicly released. SQL injection is a technique where malicious code is inserted into a database query, potentially allowing an attacker to access, modify, or delete data.

Recommendations For itsourcecode College Management System version 1.0, restrict access to the /admin/class-result.php file or sanitize the course code parameter to prevent SQL injection.

Exploitability

Exploit

Fix

Impacts

Researchers

Owenw

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers