CVE-2026-2014 is a high severity SQL injection flaw (CVSS 7.3) in itsourcecode Student Management System 1.0. The ID argument in /ramonsys/billing/index.php reaches a query unsafely and a public exploit exists. The record lists no fix, so retire the app or correct the query.
What's affected
itsourcecode Student Management System 1.0 is affected, in the file /ramonsys/billing/index.php through its ID argument. No patched version is listed. It is a second SQL injection in the same product as CVE-2026-2011, which suggests the codebase has more of the same.
How to check if you're exposed
Check whether the affected file exists in your deployment:
find . -name index.php
If it does, review how the ID or user value reaches the SQL query in that file, and check your web server logs for unusual values in that parameter.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in. It will not find flaws in code you wrote, so pair it with a review of the query in the affected file.
What to do now
- Find out whether the application is deployed anywhere you manage.
- Take it off the public internet, or put it behind a login or VPN, if it is a demo or training system.
- Change the query to use prepared statements with bound parameters, and validate the value type.
- Run the database user with the least rights the application needs, and check logs for earlier abuse.
Why it matters
SQL injection, CWE-89, happens when a request value is placed into a database query as text instead of being passed as a parameter. The database cannot tell data from instructions, so crafted input can change what the query does. CWE-74 is the parent class, improper neutralization of special elements.
The fix pattern is the same everywhere: parameterized queries, input validation and a database account with the minimum rights. The CVE is not in CISA's KEV list.
Quick check
Is a vendor patch available?
The record lists none. Fix the code yourself or retire the software.
Is exploitation confirmed in the wild?
The record says an exploit is public. It does not report attacks, and the CVE is not in KEV.
Sources
Last reviewed: 19 October 2026.
