Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authentication via the username parameter in index.php.
Attackers could gain unauthorized access to the system by bypassing authentication without valid credentials. Once authenticated, attackers could extract, modify, or delete sensitive attendance records and other database contents. The vulnerability can be exploited over the network without user interaction, making it easily accessible to remote threat actors.
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patches are available. A GitHub advisory (GHSA-h6m6-2qjp-9v82) has been published with patch information and remediation details.
Immediately apply available patches from the GitHub advisory GHSA-h6m6-2qjp-9v82. If patches cannot be applied immediately, restrict network access to the CodeAstro Simple Attendance Management System v1.0 to trusted networks only. Implement input validation and parameterized queries to neutralize SQL injection attacks. Monitor database logs for suspicious authentication attempts and SQL injection patterns. Consider upgrading to a patched version as soon as possible given the critical nature of this unauthenticated remote vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-37749 . See article
NVD published the first details for CVE-2026-37749
GitHub Advisories released a security advisory .
A CVSS base score of 9.8 has been assigned.
A proof of concept exploit has been released
[GHSA-h6m6-2qjp-9v82] A SQL injection vulnerability in CodeAstro Simple Attendance Management System v
CVE-2026-37749 - Exploits & Severity - Feedly
CVE-2026-37749 - CodeAstro Simple Attendance Management System SQL Injection CVE ID : CVE-2026-37749 Published : April 17, 2026, 3:16 p.m. | 2 hours, 41 minutes ago Description : A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows r...
CVE-2026-37749: Simple Attendance Management System 1.0 - SQL Injection
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
