Is CVE-2026-11335 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11335 being exploited in the wild.

How severe is CVE-2026-11335?

Medium severity, with a CVSS score of 6.3, published 5 June 2026.

Which products and versions are affected?

Tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3.

Is there a fix for CVE-2026-11335?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11335 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11335?

Check whether you run Tittuvarghese CollegeManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11335: tittuvarghese CollegeManagementSystem session fixation in login-form.php

CVE-2026-11335 · Severity: medium · CVSS 6.3 · Published 2026-06-05

A security flaw exists in the CollegeManagementSystem, a platform used to manage student records, staff, and academic data. An attacker can trick a user into using a specific session ID, allowing the attacker to hijack the user's account once they log in. This could lead to unauthorized access to sensitive student information or administrative functions without the attacker needing to know the user's password.

Technologies: Tittuvarghese CollegeManagementSystem. Vendors: Tittuvarghese.

Quick answers

Is CVE-2026-11335 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11335 being exploited in the wild.
How severe is CVE-2026-11335?: Medium severity, with a CVSS score of 6.3, published 5 June 2026.
Which products and versions are affected?: Tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3.
Is there a fix for CVE-2026-11335?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11335 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11335?: Check whether you run Tittuvarghese CollegeManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A session fixation vulnerability exists in the login-form.php component of the CollegeManagementSystem. The application calls session_start() but fails to invoke session_regenerate_id(true) after a successful authentication event. This allows a remote attacker to pre-determine a session identifier (PHPSESSID), force a victim to use it, and then inherit the authenticated session once the victim logs in. Successful exploitation grants the attacker full access to the victim's account, including administrative privileges if the victim is an admin. As of the advisory date, no patch has been released by the vendor.

Affected products

tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3

Timeline

2026-05-18: disclosed: Issue reported on GitHub repository
2026-06-05: advisory: CVE published via VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.