CVE-2026-121524
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A SQL injection vulnerability was found in School-Management-System (sumiie24) in the file parent_Login.php of the Public Search Feature via manipulation of the email argument. The attack can be performed remotely, and the exploit has been published and may be used. The product uses a rolling release model, so version information is not disclosed, and the vendor did not respond to the disclosure.
Risk Assessment
A remote attacker can inject arbitrary SQL queries, potentially leading to disclosure, modification, or deletion of database data and, in extreme cases, application compromise.
Recommendation
Deploy patches or mitigations (e.g., input validation and parameterized queries) as soon as possible, and consider restricting access to the application until fixed.
Other vulnerabilities in School-Management-System
See all- CVE-2026-86268High
SQL injection vulnerability in itsourcecode School Management System 1.0, affecting an unknown function in User_Login.php. Manipulating the email argument leads to SQL injection. The attack can be executed remotely, and the exploit is public.
- CVE-2026-47325Medium
The ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.
- CVE-2026-47324Medium
ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker can inject malicious JavaScript that is subsequently executed in other users’ browsers. When chained with CVE‑2025‑11661, it can be exploited remotely without privileges.
- CVE-2026-37750Medium
A reflected Cross-Site Scripting (XSS) vulnerability was found in the School Management System by mahmoudai1. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser via the unsanitized type parameter in register.php.
- CVE-2025-65136Medium
In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter. The vulnerability allows reflection of malicious script in the server response.
- CVE-2025-65134Medium
In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POST parameter.
- CVE-2025-13795Low
An XSS vulnerability in School Management System (rolling release) exists in /student-view.php in the Edit Student Info Page component. Manipulation of the First Name argument causes XSS. Remote attack is possible, exploit is public.
- CVE-2024-46334Medium
School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php. An attacker can inject malicious JavaScript that executes in the user's browser.
- CVE-2025-11056Medium
ProjectsAndPrograms School Management System 1.0 has an SQL injection vulnerability in owner_panel/fetch-data/select-students.php. Manipulating the select argument allows remote attacks. The exploit has been published.
Original NVD description (English source)
A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parent_Login.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS