CVE-2026-0733
MEDIUMOnline Course Registration System < 3.1 - SQL Injection via id/cid Parameter in manage-students.php
Title source: llmDescription
A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown function of the file /onlinecourse/admin/manage-students.php. This manipulation of the argument id/cid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
References (7)
Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.340130
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.340130
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.733328
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.733331
Exploit, Third Party Advisory related
https://note-hxlab.wetolink.com/share/cU33RBoPPAF0
Exploit, Third Party Advisory exploit
https://note-hxlab.wetolink.com/share/Tma34bofeB2L
Product product
https://phpgurukul.com/
Scores
CVSS v3
6.3
EPSS
0.0002
EPSS Percentile
6.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-74
CWE-89
Status
published
Products (1)
phpgurukul/online_course_registration_system
< 3.1
Published
Jan 09, 2026
Tracked Since
Feb 18, 2026