CVE-2026-97649

Publié : 25 septembre 2026

Modifié : 25 septembre 2026

Score CVSS

4.7

MEDIUM

Description détaillée

A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is an unknown functionality of the file example_lite.sql. Executing a manipulation can lead to use of default credentials. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/ningzichun/student-management-system/https://github.com/ningzichun/student-management-system/issues/13 https://vuldb.com/cve/CVE-2026-97649 https://vuldb.com/submit/910058 https://vuldb.com/vuln/409751 https://vuldb.com/vuln/409751/cti

Dernières Vulnérabilités

CVE-2026-97736

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

VOIR DÉTAILS

CVE-2026-97735

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

VOIR DÉTAILS

CVE-2026-97732

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

VOIR DÉTAILS