---
id: "CVE-2026-119619"
kind: "vulnerability"
aliases: ["CVE-2026-119619"]
title: "cak-filemanagement-system: SQL injection in student save page lets attackers query the database"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "cak-filemanagement-system", "fixed": [], "affected": "<= commit 5e6433246475e66462e1fea980688de96a049297", "ecosystem": "other"}]
ecosystems: []
tags: ["cak-filemanagement-system", "other", "php", "self-hosted"]
not_affected_if: ["endpoint-not-reachable", "not-deployed"]
published_at: "2026-10-30T18:17:26+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T18:59:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119619", "first_seen_at": "2026-10-30T18:55:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T18:59:50+00:00"}]
---

# cak-filemanagement-system: SQL injection in student save page lets attackers query the database

An SQL injection flaw exists in the admin/save_student.php file of the cak-filemanagement-system project, where the date, department, subject, forwarded_to, action_taken_by, section and password arguments reach a database query unsanitized. A remote attacker can read or change database contents, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:cak-filemanagement-system affected <= commit 5e6433246475e66462e1fea980688de96a049297 fixed ?

## How to check

- Check whether your deployment includes `admin/save_student.php` from the cak-filemanagement-system project.
- Confirm the project version against the affected commit `5e6433246475e66462e1fea980688de96a049297` or earlier.

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119619
- 2026-10-30T18:59:50+00:00 analyst — Only the NVD record was reachable (page text came back empty; description read from the signal). Did not find the project's issue or any maintainer response, so no fix and no auth confirmation; nothing marked verified. Fix status none rests on the NVD description (project not responding), not a vendor page. Similar save_student.php bugs in other student-management PHP apps are different products. Could settle by reading the GitHub issue linked from the NVD references.

## Documents

- [advisory] NVD CVE-2026-119619 https://nvd.nist.gov/vuln/detail/CVE-2026-119619

## From the sources

A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_