CVE Alert: CVE-2026-86268 – itsourcecode

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

**Risk verdict:** High practical risk for internet-facing deployments, requiring urgent remediation because exploitation is publicly available, although KEV and active SSVC exploitation signals are not present.

**Why this matters:** An unauthenticated attacker could target the login workflow to access or manipulate backend data, disrupt administrative functions, or establish a foothold in a school’s web environment. Likely objectives include harvesting staff, pupil or parent records, altering attendance or account data, and using the application as a staging point for further attacks. EPSS and confirmed exploitation-status data are not provided, so prevalence and near-term exploitation likelihood remain uncertain.

**Most likely attack path:** The network-reachable endpoint appears exploitable with low effort, without an account or user interaction, making automated scanning and repeated probing feasible. The stated unchanged scope limits direct impact to the application and its database, but stolen credentials or database-connected secrets could enable lateral movement into hosting, email, backups or internal services.

**Who is most exposed:** Schools and small education providers running this application directly on the internet, particularly where it shares a server or database with other services. Older, unsupported or heavily customised installations are harder to patch and more likely to retain weak monitoring.

Review web logs for abnormal input in the login email parameter.

Alert on database errors, unusual query timing and repeated failed logins.

Check for unexpected database reads, exports, account changes or administrator activity.

Hunt for web-shells, new files and outbound connections from the application host.

Mitigation and prioritisation:

Apply a vendor fix or supported replacement immediately; no remediation guidance is supplied.

Restrict exposure through VPN or allow-listing until fixed.

Use parameterised queries and validate server-side input as compensating controls.

Preserve logs and test changes in staging before deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.