CVE-2026-12175

MEDIUM

CodeAstro Student Attendance Management System createStudents.php sql injection

Title source: cna

Description

A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStudents.php. Performing a manipulation of the argument admissionNumber results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

References (6)

Core 6

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-370816 | CodeAstro Student Attendance Management System createStudents.php sql injection

https://vuldb.com/vuln/370816

Signature, Permissions Required signature permissions-required

VDB-370816 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/370816/cti

Third Party Advisory third-party-advisory

CVE-2026-12175 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-12175

Third Party Advisory third-party-advisory

Submit #837214 | codeastro Student Attendance Management System V1.0 SQL Injection

https://vuldb.com/submit/837214

Exploit exploit issue-tracking

https://github.com/fgvcbv/cve/issues/1

Product product

https://codeastro.com/

Scores

CVSS v3 4.7

EPSS 0.0033

EPSS Percentile 25.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-89

Status published

Products (1)

CodeAstro/Student Attendance Management System 1.0

Published Jun 13, 2026

Tracked Since Jun 14, 2026