CVE-2026-86268

5.5 mediumEPSS 0.4%

Medium (5.5). EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2026-09-07
Modified: 2026-09-28
Record from: the NVD, synced 2026-10-19

References

https://github.com/anglemsg2401-bot/cve/issues/6
https://itsourcecode.com/
https://vuldb.com/cve/CVE-2026-86268
https://vuldb.com/submit/903720
https://vuldb.com/vuln/399427

Check your stack JSON