CVE-2026-3411

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /admin_single_student_update.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	University Management System	1.0

References

https://github.com/dyh1213-wq/cve/issues/2Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.348306Permissions Required, VDB Entry
https://vuldb.com/?id.348306Third Party Advisory, VDB Entry
https://vuldb.com/?submit.763769Third Party Advisory, VDB Entry

Timeline

Published: Mar 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-341109.8Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: ex CVE-2026-341119.8Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: e CVE-2026-341129.8Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\CVE-2026-341139.8Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) without sanitization: exec CVE-2026-341149.8Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: e CVE-2026-341159.8Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization CVE-2026-341169.8Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(CVE-2026-341179.8Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization CVE-2026-341186.5A heap-based buffer overflow vulnerability was identified in multiple TP-Link Tapo cameras in the HTTP POST body parsing logic due to missin CVE-2026-341196.5A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented CVE-2026-34126.1A vulnerability was detected in itsourcecode University Management System 1.0. This affects an unknown part of the file /att_single_view.php CVE-2026-341206.5A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream