# CVE-2026-86213: Mstfakts College-Management-System SQL injection in book search

Source: https://junglewise.ai/threats/cve-2026-86213-mstfakts-college-management-system-sql-injection-in-book-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86213 · Severity: high · CVSS 7.3 · Published 2026-09-06

The Mstfakts College-Management-System is a web-based university management platform that allows students and faculty to search a library catalog. An unauthenticated attacker can inject malicious SQL commands through the book search functionality to extract sensitive database records, including user email addresses, password hashes, phone numbers, and account roles, bypassing all access controls.

## Quick answers

**Is CVE-2026-86213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86213 being exploited in the wild.

**How severe is CVE-2026-86213?** High severity, with a CVSS score of 7.3, published 6 September 2026.

**Which products and versions are affected?** Mstfakts College-Management-System All versions including commit 82ab01d057d96c8893c419cd9cb6870120faaea3 and prior.

**Is there a fix for CVE-2026-86213?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86213 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86213?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a classic SQL injection vulnerability (CWE-89) in the book search handler of Front-end/university.php and Front-end/faculty.php. The vulnerable code directly concatenates unsanitized POST parameters (book_name and book_author) into a SQL SELECT query without using prepared statements or parameterized queries. The search function is unauthenticated and network-reachable, allowing any remote user to craft UNION SELECT payloads to exfiltrate data from other database tables (e.g., the visitor table containing credentials). An attacker can disclose account identities, password hashes, phone numbers, and roles. The project uses a rolling release model and has not yet patched the issue despite early notification via GitHub issue report.

## Affected products

- Mstfakts College-Management-System All versions including commit 82ab01d057d96c8893c419cd9cb6870120faaea3 and prior

## Timeline

- 2026-07-20: disclosed: Vulnerability reported via GitHub issue #5
- 2026-09-06: advisory: CVE-2026-86213 published on NVD

## References

- [https://github.com/Mstfakts/College-Management-System/](https://github.com/Mstfakts/College-Management-System/)
- [https://github.com/Mstfakts/College-Management-System/issues/5](https://github.com/Mstfakts/College-Management-System/issues/5)