# CVE-2026-82620: Soarkey StudentManagement SQL injection in course ranking

Source: https://junglewise.ai/threats/cve-2026-82620-soarkey-studentmanagement-sql-injection-in-course-ranking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82620 · Severity: medium · CVSS 6.3 · Published 2026-08-31

Soarkey StudentManagement is a Java-based student information management system used by educational institutions to track student records, courses, and grades. A SQL injection vulnerability in the course ranking feature allows attackers to bypass authentication requirements, extract sensitive data (including admin credentials), and modify database queries by manipulating the course number parameter. This could lead to unauthorized access to student records and system compromise.

Technologies: [Soarkey StudentManagement](https://junglewise.ai/threats/technologies/studentmanagement). Vendors: [Soarkey](https://junglewise.ai/threats/vendors/soarkey).

## Quick answers

**Is CVE-2026-82620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82620 being exploited in the wild.

**How severe is CVE-2026-82620?** Medium severity, with a CVSS score of 6.3, published 31 August 2026.

**Which products and versions are affected?** Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e.

**Is there a fix for CVE-2026-82620?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82620 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82620?** Check whether you run Soarkey StudentManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw in the `course_ranking` method of `CourseDao.java`, where user-supplied input from the `cno` (course number) parameter is concatenated directly into a SQL query string. Although the code uses `PreparedStatement`, it defeats parameterization by embedding the unsanitized input before statement preparation. An unauthenticated remote attacker can exploit this via HTTP GET/POST requests to the `/AdminDao` endpoint, using boolean-based or UNION-based injection techniques to enumerate tables and extract arbitrary data (e.g., usernames, passwords). The vulnerable code is exposed in commit `e08f7f1d5015af407aa4cca0ada3dea189b4937e` and public proof-of-concept exploits exist. No patch has been released as the maintainers have not responded to the issue report.

## Affected products

- Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e

## Timeline

- 2026-08-31: disclosed: CVE-2026-82620 published on NVD
- 2026-08-31: other: Public exploit proof-of-concept released

## References

- [https://github.com/Soarkey/StudentManagement/](https://github.com/Soarkey/StudentManagement/)
- [https://github.com/Soarkey/StudentManagement/issues/33](https://github.com/Soarkey/StudentManagement/issues/33)

## Related threats

- [Soarkey StudentManagement privilege escalation in registration](https://junglewise.ai/threats/cve-2026-90787-soarkey-studentmanagement-privilege-escalation-in-registration)
- [Soarkey StudentManagement authorization bypass in Administrative Servlet](https://junglewise.ai/threats/cve-2026-82621-soarkey-studentmanagement-authorization-bypass-in-administrative)