CVE-2026-86213

Name of the Vulnerable Software and Affected Versions Mstfakts College-Management-System (affected versions not specified)

Description A remote SQL injection exists within the Search Handler component. The issue occurs in the mysqli query() function located in the Front-end/university.php file, where improper handling of the book name and book author arguments allows for the execution of arbitrary SQL commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the Front-end/university.php file or avoid using the book name and book author parameters until a patch is released.