# CVE-2026-9470: yashpokharna2555 StudentManagementSystem SQL injection in student_trans.php

Source: https://junglewise.ai/threats/cve-2026-9470-yashpokharna2555-studentmanagementsystem-sql-injection-in-student  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9470 · Severity: high · CVSS 7.3 · Published 2026-05-25

A security vulnerability exists in the Student Management System, a software tool used to manage student records and administrative data. An attacker can exploit this flaw to bypass security checks and insert unauthorized information into the database, such as fake student records or malicious scripts. This could lead to data corruption, unauthorized access to sensitive information, or the disruption of school administrative operations.

Technologies: [Yashpokharna2555 StudentManagementSystem](https://junglewise.ai/threats/technologies/studentmanagementsystem). Vendors: [Yashpokharna2555](https://junglewise.ai/threats/vendors/yashpokharna2555).

## Quick answers

**Is CVE-2026-9470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9470 being exploited in the wild.

**How severe is CVE-2026-9470?** High severity, with a CVSS score of 7.3, published 25 May 2026.

**Which products and versions are affected?** Yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203.

**Is there a fix for CVE-2026-9470?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9470 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9470?** Check whether you run Yashpokharna2555 StudentManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the 'student_trans.php' file of the StudentManagementSystem (commit cb2f558). The root cause is a failure to implement authentication checks (missing confirm_logged_in call) combined with the direct concatenation of user-supplied POST parameters—specifically FIRST_NAME, Last_Name, and EMAIL—into an INSERT SQL statement. A remote, unauthenticated attacker can exploit this by sending a crafted POST request to the affected endpoint. This allows for unauthorized data insertion, potential extraction of database information, or the injection of Cross-Site Scripting (XSS) payloads into the student database. As of the advisory date, the project has not responded to the issue report.

## Affected products

- yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203

## Timeline

- 2026-04-27: disclosed: Issue reported on GitHub repository
- 2026-05-25: advisory: CVE-2026-9470 published

## References

- [https://github.com/yashpokharna2555/StudentManagementSystem/](https://github.com/yashpokharna2555/StudentManagementSystem/)
- [https://github.com/yashpokharna2555/StudentManagementSystem/issues/3](https://github.com/yashpokharna2555/StudentManagementSystem/issues/3)
- [https://vuldb.com/submit/814001](https://vuldb.com/submit/814001)
- [https://vuldb.com/vuln/365451](https://vuldb.com/vuln/365451)
- [https://vuldb.com/vuln/365451/cti](https://vuldb.com/vuln/365451/cti)

## Related threats

- [yashpokharna2555 StudentManagementSystem XSS in student.php](https://junglewise.ai/threats/cve-2026-9471-yashpokharna2555-studentmanagementsystem-xss-in-student-php)
- [yashpokharna2555 StudentManagementSystem SQL injection in success.php](https://junglewise.ai/threats/cve-2026-9469-yashpokharna2555-studentmanagementsystem-sql-injection-in-success)