CVE-2026-3261 is a SQL injection in itsourcecode School Management System 1.0, scored CVSS 7.3 (high). The ID argument of the settings page reaches a database query unsafely. I could not confirm a vendor fix, so do not expose this application to the internet and fix the query yourself if you run it.
What's affected
The NVD record names itsourcecode School Management System version 1.0, in the file /settings/index.php of the Setting Handler component, through the argument ID. NVD says the attack can be started remotely and that an exploit has been published.
No fixed version appears in the record or in the public write-up listed in its references. Check the vendor site before assuming a patch exists.
How to check if you're exposed
If this application is in your estate, find it first. It is a PHP project distributed as downloadable source code, so it may sit in an unmanaged folder.
grep -rln "settings" --include=index.php . | head
Then open the settings handler and look at how the ID value reaches the SQL statement. If the value is concatenated into the query string, you are exposed. If you cannot tell, treat it as exposed.
Check web server logs for requests to the settings page with unusual ID values.
What to do now
- Take the application off the public internet, or put it behind a VPN or an allowlist.
- Ask the vendor for a patched build, and confirm in writing whether one exists.
- If you must keep it running, change the vulnerable query to use prepared statements with bound parameters.
- Use a database account with only the rights the application needs.
- Plan a move to a maintained product if the vendor does not respond.
Why it matters
The weaknesses are CWE-89, SQL injection, and CWE-74, the broader injection class. User input becomes part of a query, so the database cannot tell data from instructions.
Sample projects sold or shared as source code are often written for learning, not for hostile traffic. When one of them ends up serving real records such as student data, the gap shows. Public exploit details make the risk higher.
The record's KEV flag is false.
Quick check
Is there a patch?
None is confirmed in the record or the listed write-up. Check with the vendor and treat the app as unpatched until you hear otherwise.
Sources
Last reviewed: 19 October 2026.
