---
id: "CVE-2026-121524"
kind: "vulnerability"
aliases: ["CVE-2026-121524"]
title: "School-Management-System: SQL injection through the public search email field"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "School-Management-System", "fixed": [], "affected": "<= d946d649c7c95e101fc5679ecd91999533bb10d7 (rolling release, no versions)", "ecosystem": "github"}]
ecosystems: []
tags: ["no-fix", "package", "php", "school-management-system", "self-hosted"]
not_affected_if: ["no-public-access", "not-deployed"]
published_at: "2026-11-03T22:19:46+00:00"
first_seen_at: "2026-11-03T23:15:09+00:00"
updated_at: "2026-11-03T23:17:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121524", "first_seen_at": "2026-11-03T23:15:09+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T23:17:22+00:00"}]
---

# School-Management-System: SQL injection through the public search email field

A school management web app's public search feature passes the email parameter of parent_Login.php into a SQL query without proper escaping. A remote attacker can read or change the underlying database, and a public exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:School-Management-System affected <= d946d649c7c95e101fc5679ecd91999533bb10d7 (rolling release, no versions) fixed ?

## How to check

- Look for parent_Login.php in your deployed sumiie24/School-Management-System code (a small PHP/MySQL student project; the repo says code is for the Parent module only).
- Compare your checkout to commit d946d649c7c95e101fc5679ecd91999533bb10d7; the CVE is for that commit and earlier, with no release versions. A newer commit is not confirmed safe.
- Review how parent_Login.php builds its SQL from the email parameter.

## Timeline

- 2026-11-03T23:15:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121524
- 2026-11-03T23:17:22+00:00 analyst — Repo shows no fix, advisory, or issue about this CVE; the CVE text (VulDB) says the vendor did not respond and no remediation is listed (OpenCVE). The public exploit link was not found, so poc_count stays 0. No fix; the fix status is based on the absence of a fix and a vendor statement, not on a vendor page, so nothing is marked verified.

## Documents

- [describes] sumiie24/School-Management-System repository https://github.com/sumiie24/School-Management-System
- [mentions] OpenCVE CVE-2026-121524 (VulDB text, no remediation) https://app.opencve.io/cve/CVE-2026-121524

## From the sources

A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parent_Login.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_