CVE-2026-2018

EUVD-2026-5688 · Published Feb 6, 2026

A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Technologies

Itsourcecode School Management System

Weaknesses

CWE-74CWE-89

CVSS scores

v4.05.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
v3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
v2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Execution Stealth Defense Impairment

T1190Exploit Public-Facing Application T1027Obfuscated Files or Information T1574.006Dynamic Linker Hijacking T1574.007Path Interception by PATH Environment Variable T1690Prevent Command History Logging

References

Potentially impacted assets

See if this affects your attack surface