Is CVE-2026-86518 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86518 being exploited in the wild.

How severe is CVE-2026-86518?

Medium severity, with a CVSS score of 6.3, published 8 September 2026.

Which products and versions are affected?

Code-Projects Student Crud Operation 1.0.

Is there a fix for CVE-2026-86518?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86518 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86518?

Check whether you run Code-Projects Student Crud Operation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86518: code-projects Student Crud Operation SQL injection in edit.php

CVE-2026-86518 · Severity: medium · CVSS 6.3 · Published 2026-09-08

Student Crud Operation is a PHP-based student management application available as open-source software. The application contains a time-based blind SQL injection vulnerability in the edit.php file that allows remote attackers to extract sensitive database information by manipulating the ID parameter. This could lead to unauthorized access to student records and database compromise.

Vendors: Code-Projects.

Quick answers

Is CVE-2026-86518 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86518 being exploited in the wild.
How severe is CVE-2026-86518?: Medium severity, with a CVSS score of 6.3, published 8 September 2026.
Which products and versions are affected?: Code-Projects Student Crud Operation 1.0.
Is there a fix for CVE-2026-86518?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86518 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86518?: Check whether you run Code-Projects Student Crud Operation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A time-based blind SQL injection vulnerability exists in the /edit.php file of Student Crud Operation 1.0, triggered by unsanitized user input in the ID parameter. The vulnerable component fails to properly validate or parameterize database queries, allowing an attacker to inject arbitrary SQL commands. The attack can be initiated remotely without authentication by crafting malicious ID values that execute time-delay payloads to infer database structure and exfiltrate data. An attacker can extract sensitive student information, enumerate database contents, or potentially escalate privileges depending on database permissions. No patch information is currently available; remediation requires parameterized queries or input validation.

Affected products

code-projects Student Crud Operation 1.0

Timeline

2026-09-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.