CVE-2026-26694 is a critical SQL injection flaw (CVSS 9.8) in Simple Student Alumni System 1.0, a PHP project from code-projects. The weak point is /TracerStudy/modal_view.php. The record names no fixed release, so the practical fix is to correct the query code or take the app offline.
What's affected
The NVD record lists Simple Student Alumni System version 1.0 as vulnerable, in the file /TracerStudy/modal_view.php. This is one of 3 SQL injection CVEs assigned against Simple Student Alumni System 1.0 in the same batch, each tied to a different file. Fixing one file does not fix the others.
No patched version is named in the record or in the public report it links to. Treat every copy of version 1.0 as exposed until you have changed the code yourself or confirmed a newer release with the project page.
How to check if you're exposed
Find out whether you run this software at all. Search your servers and repositories for the file name and the project folder:
find /var/www -name "modal_view.php" 2>/dev/null
If the file turns up, open it and look at how the database query is built. A query assembled by joining request values into a string is the pattern the report describes. A query that uses bound parameters is not.
A dependency scan will not catch this, because the flaw is in the application's own code.
What to do now
- Decide whether the application needs to exist. Sample and tutorial projects often do not, and removing one ends the risk.
- If it must stay, take it off the public internet and put it behind a VPN or an IP allow list.
- Rewrite the query in
modal_view.phpto use prepared statements with bound parameters (PDO or mysqli prepared queries in PHP). Do the same for every other file that builds SQL from request data. - Check web server and database logs for odd query errors or unusually long requests to this path.
Why it matters
SQL injection (CWE-89) happens when an application builds a database query by pasting user input into the SQL text. The database cannot tell which part was meant as data and which as instructions, so a crafted value can change what the query does. The CVSS vector for this record, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, says it can be reached over the network with no login and no user action, which is why it scores 9.8.
The record is not marked as exploited in the wild, and it does not appear in the CISA Known Exploited Vulnerabilities catalog. A public write-up exists, though, so anyone who finds the software online has a head start. The lasting fix is a habit, not a patch: parameterized queries everywhere.
Quick check
Is there a patch for CVE-2026-26694?
The record and the report it links to name no fixed version. Check the project page for a newer release, and plan to fix the query code yourself.
Sources
Last reviewed: 19 October 2026.
