CVE-2026-9574

HighCVSS 7.3/10Last modified Jul 23, 2026

Description

A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code of the file /admin/modules/student/trans.php. Executing a manipulation of the argument studentId/cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-95757.3A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the fCVE-2026-957546.9In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification bCVE-2026-95764.9The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via theCVE-2026-95774.8The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the CVE-2026-95796.3A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit oCVE-2026-95807.3A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/CVE-2026-958055.3A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permCVE-2026-958067.7MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.  The phar stream wrapper causCVE-2026-958076.4The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, CVE-2026-958087.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via theCVE-2026-958097.2The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to StCVE-2026-95816.3A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such mani
CVE-2026-9574: High severity, CVSS 7.3 | Vulnix