CVE-2026-6488

MediumCVSS 6.3

Published: 17/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

A vulnerability was identified in QueryMine sms in admin/editcourse.php where manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely and a public exploit is available. The product uses rolling releases, so no specific affected or fixed versions are available.

Risk Assessment

Potential unauthorized database queries, data leakage or modification, and application compromise. Public exploit availability increases the likelihood of rapid exploitation.

Recommendation

Apply the vendor fix as soon as possible or temporarily disable/restrict access to admin/editcourse.php. Enforce input validation and WAF rules to block SQL injection attempts.

Other vulnerabilities in QueryMine sms

CVE-2026-6489Medium
A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This issue affects some unknown processing of the file admin/addteacher.php of the Background Management Page component. Manipulation of the image argument results in unrestricted upload. The attack can be launched remotely and the exploit has been released to the public. The vendor was contacted but did not respond.

Original NVD description (English source)

A vulnerability was identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This vulnerability affects unknown code of the file admin/editcourse.php of the component GET Request Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS