CVE-2026-2073

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/user/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	School Management System	1.0

References

https://github.com/Sherlocksbs/CVE/issues/1Exploit, Issue Tracking
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.344639Permissions Required, VDB Entry
https://vuldb.com/?id.344639Third Party Advisory, VDB Entry
https://vuldb.com/?submit.745482Third Party Advisory, VDB Entry

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-207303.3A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive informa CVE-2026-207316.1Improper buffer restrictions for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Un CVE-2026-207324.3A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Softwa CVE-2026-207335.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-207345.6Improper initialization in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT), and some Intel(R) Standard Manageabi CVE-2026-207367.5Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository ma CVE-2026-207377.9Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device CVE-2026-207388.5Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: User Applications may a CVE-2026-207397.4Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of se CVE-2026-20746.3A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of t CVE-2026-207417.4Improper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. Unprivi CVE-2026-207428.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote c