CVE-2026-2171

This is a critical SQL injection flaw in the Online Student Management System's login page. Attackers can remotely inject malicious code through the username or password fields to manipulate the database.

Who is affected

Any organization using version 1.0 of this system is affected. An attacker could steal, modify, or delete sensitive student data, or potentially gain unauthorized access to the system.

Recommended fix

Immediately apply any official patch from the vendor. If none is available, use parameterized queries to fix the accounts.php file and restrict direct public access to the system until patched.