Live › vulnerability › CVE-2026-121524
A school management web app's public search feature passes the email parameter of parent_Login.php into a SQL query without proper escaping. A remote attacker can read or change the underlying database, and a public exploit has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:15 UTC. All times on this page are UTC.
Schools or organisations that run the sumiie24 School-Management-System web application with its public search feature exposed. The sources say the product is a rolling release with no version information, and that the vendor did not respond to disclosure, so no fixed version is known. Installations not serving this code path from the internet are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| School-Management-System | github | <= d946d649c7c95e101fc5679ecd91999533bb10d7 (rolling release, no versions) | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parent_Login.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121524")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.