Is CVE-2026-11530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11530 being exploited in the wild.

How severe is CVE-2026-11530?

High severity, with a CVSS score of 7.3, published 8 June 2026.

Which products and versions are affected?

imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46.

Is there a fix for CVE-2026-11530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11530 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11530?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11530: imvks786 student_management_system SQL injection in Login component

CVE-2026-11530 · Severity: high · CVSS 7.3 · Published 2026-06-08

A vulnerability exists in the imvks786 Student Management System, a web application used for managing educational records. An attacker can bypass the login screen to gain unauthorized access to the system as a student or administrator. This could lead to the theft of sensitive student data, unauthorized modification of permissions, or the deletion of academic records.

Quick answers

Is CVE-2026-11530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11530 being exploited in the wild.
How severe is CVE-2026-11530?: High severity, with a CVSS score of 7.3, published 8 June 2026.
Which products and versions are affected?: imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46.
Is there a fix for CVE-2026-11530?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11530 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11530?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the Login component of the imvks786 student_management_system due to improper neutralization of special elements in the 'usr' and 'pwd' parameters. Specifically, in index.php, user-supplied input is concatenated directly into SQL queries without parameterization or escaping. A remote, unauthenticated attacker can exploit this by sending a specially crafted POST request (e.g., using 'OR 1=1') to bypass authentication. Successful exploitation allows for full session establishment, unauthorized data deletion via see.php, and privilege escalation. As of the advisory date, no patch has been released by the maintainer.

Affected products

imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46

Timeline

2026-05-25: disclosed: Issue reported to the developer via GitHub
2026-06-08: advisory: NVD/VulDB advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.