CVE-2026-2190
Last modified
CVE-2026-2190 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Itsourcecode | School Management System | 1.0 |
References
- https://github.com/yyue02/cve/issues/2Exploit, Issue Tracking
- https://itsourcecode.com/Product
- https://vuldb.com/?ctiid.344893Permissions Required, VDB Entry
- https://vuldb.com/?id.344893Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.749783Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-2190?
How severe is CVE-2026-2190?
How do I fix CVE-2026-2190?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-21894n8n is an open source workflow automation platform. In versi…6.5
- CVE-2026-21895The `rsa` crate is an RSA implementation written in rust. Pr…5.3
- CVE-2026-21896Kirby is an open-source content management system. From vers…5.7
- CVE-2026-21897CryptoLib provides a software-only solution using the CCSDS …7.3
- CVE-2026-21898CryptoLib provides a software-only solution using the CCSDS …8.2
- CVE-2026-21899CryptoLib provides a software-only solution using the CCSDS …4.9
- CVE-2026-21900CryptoLib provides a software-only solution using the CCSDS …5.9
- CVE-2026-21901A NULL Pointer Dereference vulnerability in the management d…6.7
- CVE-2026-21902An Incorrect Permission Assignment for Critical Resource vul…9.8
- CVE-2026-21903A Stack-based Buffer Overflow vulnerability in the Packet Fo…7.1
- CVE-2026-21904An Improper Neutralization of Input During Web Page Generati…6.1
- CVE-2026-21905A Loop with Unreachable Exit Condition ('Infinite Loop') vul…8.7
Are you affected by CVE-2026-2190?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST