CVE-2026-2011 is a high severity SQL injection flaw (CVSS 7.3) in itsourcecode Student Management System 1.0. The ID argument in /ramonsys/enrollment/controller.php reaches a query unsafely, and a public exploit exists. The record lists no fix, so retire the app or fix the query.
What's affected
itsourcecode Student Management System 1.0 is affected, specifically the file /ramonsys/enrollment/controller.php and its ID argument. The record lists no patched version. Sample style PHP projects like this one rarely ship updates, so assume you must fix it yourself.
How to check if you're exposed
Check whether the affected file exists in your deployment:
find . -name controller.php
If it does, review how the ID or user value reaches the SQL query in that file, and check your web server logs for unusual values in that parameter.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in. It will not find flaws in code you wrote, so pair it with a review of the query in the affected file.
What to do now
- Find out whether the application is deployed anywhere you manage.
- Take it off the public internet, or put it behind a login or VPN, if it is a demo or training system.
- Change the query to use prepared statements with bound parameters, and validate the value type.
- Run the database user with the least rights the application needs, and check logs for earlier abuse.
Why it matters
SQL injection, CWE-89, happens when a request value is placed into a database query as text instead of being passed as a parameter. The database cannot tell data from instructions, so crafted input can change what the query does. CWE-74 is the parent class, improper neutralization of special elements.
The fix pattern is the same everywhere: parameterized queries, input validation and a database account with the minimum rights. The CVE is not in CISA's KEV list.
Quick check
Is a vendor patch available?
The record lists none. Fix the code yourself or retire the software.
Is exploitation confirmed in the wild?
The record says an exploit is public. It does not report attacks, and the CVE is not in KEV.
Sources
Last reviewed: 19 October 2026.
