CVE-2026-5669

CVE-2026-5669 is a SQL injection vulnerability in the Cyber-III Student-Management-System affecting the /login.php file's Parameter Handler component, specifically through manipulation of the Password argument. The flaw allows remote attackers to inject malicious SQL queries without authentication, and proof-of-concept code has been publicly disclosed. Due to the project's rolling release model, specific version information is unavailable, though the vulnerability extends through commit 1a938fa61e9f735078e9b291d2e6215b4942af3f. The vulnerability carries a CVSS 3.1 score of 7.3 (High), with a network-based attack vector requiring low complexity and no user interaction or special privileges. This configuration indicates potential compromise of data confidentiality, integrity, and availability. The EPSS probability of exploitation is extremely low at 0.0004, suggesting this threat is not currently prioritized in active exploit campaigns. The exploit has been publicly disclosed and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities list or Hot List, indicating no current evidence of active exploitation in the wild. However, the public availability of exploit code presents an ongoing risk. The project development team was notified early but has not responded, leaving affected organizations without an official patch and dependent on vendor mitigation efforts.