CVE-2026-86672

MediumCVSS 5.3/10Last modified Sep 11, 2026

Description

A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

Vendor	Product	Versions
ningzichun	Student Management System	98760f5711cf6dc8b4adca53a9e207ca49b02ebf

References

Timeline

Published: Sep 8, 2026
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-866737.3A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issu CVE-2026-866746.3A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerabi CVE-2026-866756.3A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/us_edit.php. CVE-2026-866778.8ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potenti CVE-2026-866788.8ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and CVE-2026-866797.1ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-pr CVE-2026-86682.3A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contai CVE-2026-866817.6ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-priv CVE-2026-866838.1ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.CVE-2026-866847.1The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instance CVE-2026-866887.4Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browse CVE-2026-866895.9Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subs