Live › vulnerability › CVE-2026-119619
An SQL injection flaw exists in the admin/save_student.php file of the cak-filemanagement-system project, where the date, department, subject, forwarded_to, action_taken_by, section and password arguments reach a database query unsanitized. A remote attacker can read or change database contents, and a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Teams running the 37954679 cak-filemanagement-system PHP project (a small GitHub project, no releases) on a web-reachable server are exposed through admin/save_student.php, where several form fields reach a SQL query unsanitized. NVD and the CNA rate the attack as remote with no privileges required, but I could not read the project's issue to confirm whether the endpoint needs a login. Anyone not running this project can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| cak-filemanagement-system | other | <= commit 5e6433246475e66462e1fea980688de96a049297 | – |
admin/save_student.php from the cak-filemanagement-system project.5e6433246475e66462e1fea980688de96a049297 or earlier.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-119619")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.