Is CVE-2026-97649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97649 being exploited in the wild.

How severe is CVE-2026-97649?

Medium severity, with a CVSS score of 4.7, published 25 September 2026.

Which products and versions are affected?

Ningzichun Student-Management-System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.

Is there a fix for CVE-2026-97649?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-97649 attacked?

It is attacked over the network.

Am I affected by CVE-2026-97649?

Check whether you run Ningzichun Student-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97649: ningzichun student-management-system default credentials in sample database

CVE-2026-97649 · Severity: medium · CVSS 4.7 · Published 2026-09-25

A student course selection management system distributed with a sample database that contains a hard-coded administrator account with a publicly documented default password. Anyone deploying the system using the supplied sample data and failing to change the credentials can be remotely accessed and fully compromised by an attacker, gaining complete control over student and course selection information.

Technologies: Ningzichun Student-Management-System. Vendors: Ningzichun.

Quick answers

Is CVE-2026-97649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97649 being exploited in the wild.
How severe is CVE-2026-97649?: Medium severity, with a CVSS score of 4.7, published 25 September 2026.
Which products and versions are affected?: Ningzichun Student-Management-System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.
Is there a fix for CVE-2026-97649?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-97649 attacked?: It is attacked over the network.
Am I affected by CVE-2026-97649?: Check whether you run Ningzichun Student-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use of hard-coded credentials in example_lite.sql; the sample database initializes a user_admin account with username "admin" and a well-known MD5 hash (21232f297a57a5a743894a0e4a801fc3, which is the hash of "admin"). The login handler in login.php compares submitted password hashes directly against the stored value, allowing unauthenticated remote authentication if the sample credentials are not changed during deployment.

Affected products

ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf

Timeline

2026-09-25: disclosed
2026-07-18: other: Issue reported on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.