CVE-2026-3413 is a high severity (CVSS 7.3) SQL injection in itsourcecode University Management System 1.0, in the single student page. The record says the exploit is public. No fix is listed, so isolate the app from the internet or replace the query code.
What's affected
The record lists the University Management System, version 1.0. The affected file is /admin_single_student.php, and the argument is ID.
This is the second CVE in the same product in the same week. The first, CVE-2026-3411, is in /admin_single_student_update.php. No patched version is given for either.
How to check if you're exposed
Search your estate for the University Management System. If a copy is running, read the web server log for requests to /admin_single_student.php and look at the source addresses.
The vector shows the page can be called over the network with no privileges. That means any visitor who can reach the server can reach the page.
A code search for string-built SQL in the project will turn up more pages with the same pattern. Look for queries made by joining a request value to SQL text.
What to do now
- Find any running copy of the University Management System.
- Take it off the public internet or restrict access to trusted addresses.
- Replace string-built SQL with prepared statements across the whole project.
- Review student and admin tables for unexpected changes.
- Replace the application if it holds real records.
Why it matters
The record lists CWE-89 (SQL injection) and CWE-74 (injection). The ID argument becomes part of a database query without being bound as data.
This class of bug has a long-known fix: parameterized queries. It costs a few lines per query and removes the problem at the root, which is why the project-wide pattern matters more than any single file. The record does not mark the CVE as exploited and it is not on the CISA KEV list, though a public exploit is mentioned.
Quick check
How do I fix this without a vendor patch?
Change each query to use bound parameters, then limit who can reach the app. A vendor fix is not listed in the record.
Sources
Last reviewed: 19 October 2026.
