CVE-2026-3411 is a high severity (CVSS 7.3) SQL injection in itsourcecode University Management System 1.0, in the single student update page. A public exploit exists per the record. No fix is listed, so take the app off public networks or use prepared statements.
What's affected
The record lists the University Management System, version 1.0. The affected file is /admin_single_student_update.php, and the injectable argument is ID.
A sibling record, CVE-2026-3413, covers a different page in the same product. The record offers no patched version for either, so assume the whole application has the same habit of building queries by joining strings.
How to check if you're exposed
Look for the University Management System in web roots, containers and code repositories. Free student projects of this kind are often put on a server for a demo and left there.
If it exists, check the web logs for requests to /admin_single_student_update.php and see whether callers include unknown addresses. The record's vector says no login is needed to reach the page.
Then review student records and admin accounts for unexpected changes.
What to do now
- Search for the University Management System across hosts and repositories.
- Block internet access to any copy, or limit it to a trusted network.
- Rewrite database calls in the affected file to use bound parameters, and check the other pages in the project for the same pattern.
- Check admin accounts and student tables for changes.
- If the system holds real records, move to a maintained product.
Why it matters
The weakness is CWE-89, with the parent class CWE-74. An ID value from the request flows into a SQL string, and the database cannot tell data from commands.
Two CVEs in one small project is a clue to the root cause. When one page builds queries by joining strings, the rest of the codebase usually does too, so fixing a single file does not make the application safe. The record does not say this CVE is exploited and it is not on the CISA KEV list. It does say a public exploit exists.
Quick check
Does fixing one page solve both CVEs?
No. This one covers the update page and CVE-2026-3413 covers another page. Fix the query pattern across the whole project.
Sources
Last reviewed: 19 October 2026.
