Is CVE-2026-86673 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86673 being exploited in the wild.

How severe is CVE-2026-86673?

High severity, with a CVSS score of 7.3, published 8 September 2026.

Which products and versions are affected?

ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.

Is there a fix for CVE-2026-86673?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86673 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86673?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86673: ningzichun Student Management System hard-coded database credentials

CVE-2026-86673 · Severity: high · CVSS 7.3 · Published 2026-09-08

The Student Management System contains hard-coded database credentials in its configuration file that are exposed in the repository. When deployed with default settings, these credentials allow anyone with access to the source code or the publicly reachable Adminer database interface to gain full administrative access to the database, potentially exposing student personal information, password hashes, and enabling unauthorized modification of grades and enrollment records.

Quick answers

Is CVE-2026-86673 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86673 being exploited in the wild.
How severe is CVE-2026-86673?: High severity, with a CVSS score of 7.3, published 8 September 2026.
Which products and versions are affected?: ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.
Is there a fix for CVE-2026-86673?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86673 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86673?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A hard-coded credential vulnerability exists in config/database.php where database connection parameters (username "hw", password "hwhwhw") are committed to the repository in plaintext. The system also includes a publicly reachable Adminer database management interface at /config/adminer.php that can be accessed remotely without authentication over the network. An attacker with repository access or who discovers the web-accessible Adminer interface can use the hard-coded credentials to authenticate and gain full administrative access to the database. This allows unauthorized access to sensitive student PII, password hashes, and the ability to modify grades, enrollment data, and account records. The project uses a rolling release model and has not yet responded to the vulnerability report.

Affected products

ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf

Timeline

2026-09-08: disclosed: Public disclosure via NVD
2026-07-29: other: Issue reported to project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.