Is CVE-2026-11334 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11334 being exploited in the wild.

How severe is CVE-2026-11334?

High severity, with a CVSS score of 7.3, published 5 June 2026.

Which products and versions are affected?

tittuvarghese CollegeManagementSystem commit 3e476335cfbfb9a049e09f474c7ec885f69a9df3.

Is there a fix for CVE-2026-11334?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11334 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11334?

Check whether you run Tittuvarghese College Management System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11334: tittuvarghese CollegeManagementSystem SQL injection in fetch.php

CVE-2026-11334 · Severity: high · CVSS 7.3 · Published 2026-06-05

A security vulnerability exists in the CollegeManagementSystem, a platform used by educational institutions to manage student records, staff, and grades. An attacker can exploit this flaw to bypass security controls and directly query the underlying database without needing a username or password. This could lead to the theft of sensitive information, including student records, staff credentials, and academic data, potentially disrupting school operations and compromising student privacy.

Technologies: Tittuvarghese College Management System. Vendors: Tittuvarghese.

Quick answers

Is CVE-2026-11334 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11334 being exploited in the wild.
How severe is CVE-2026-11334?: High severity, with a CVSS score of 7.3, published 5 June 2026.
Which products and versions are affected?: tittuvarghese CollegeManagementSystem commit 3e476335cfbfb9a049e09f474c7ec885f69a9df3.
Is there a fix for CVE-2026-11334?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11334 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11334?: Check whether you run Tittuvarghese College Management System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in dashboard_page/forms/fetch.php of the tittuvarghese CollegeManagementSystem. The application fails to sanitize or parameterize the 'department_code' POST parameter before embedding it into a MySQL query. Because the endpoint lacks authentication checks, a remote, unauthenticated attacker can use boolean-based or time-based blind SQL injection techniques to extract sensitive data from the database. The vulnerability is present in the rolling release version (specifically identified at commit 3e47633); as of the advisory date, no official patch has been released by the maintainer.

Affected products

tittuvarghese CollegeManagementSystem commit 3e476335cfbfb9a049e09f474c7ec885f69a9df3

Timeline

2026-05-18: disclosed: Issue reported to the maintainer on GitHub
2026-06-05: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.