CVE-2026-18958
Last modified
CVE-2026-18958 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| imranrisal-dev | Student-Management-System | 18ea7904c339e0c7b0234724a79c939ce6191def; a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-18958?
How severe is CVE-2026-18958?
How do I fix CVE-2026-18958?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18949A flaw was found in odh-dashboard. This vulnerability allows…8.8
- CVE-2026-1895A flaw has been found in WeKan up to 8.20. Affected is the f…6.3
- CVE-2026-18950A flaw was found in odh-dashboard. An authenticated user of …8.8
- CVE-2026-18951A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay…8.8
- CVE-2026-18953Improper limitation of a pathname to a restricted directory …8.8
- CVE-2026-18954Incorrect authorization in the aggregation pipeline tool in …5.7
- CVE-2026-18959A flaw has been found in yushine InnoShop up to 0.8.2. Affec…5.4
- CVE-2026-1896A vulnerability has been found in WeKan up to 8.20. Affected…6.3
- CVE-2026-18960The Block User Account WordPress plugin before 2.0.1 does no…5.4
- CVE-2026-18961The Social Login, Passkeys, Magic Link & Email OTP – Passwor…8.1
- CVE-2026-18962The WP Photo Album Plus WordPress plugin before 9.2.09.002 d…4.3
- CVE-2026-18967A flaw was found in the SAML broker component of Keycloak, a…8.1
Are you affected by CVE-2026-18958?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST