CVE-2026-6595

OVERVIEW CVE-2026-6595 is a SQL injection vulnerability discovered in ProjectsAndPrograms School Management System affecting the buslocation.php file's HTTP GET Parameter Handler. The vulnerability exists in the bus_id parameter, which fails to properly sanitize user input before processing database queries. The affected product utilizes a rolling release model, making it difficult to determine specific version boundaries. SEVERITY The vulnerability carries a CVSS v3.1 score of 7.3 (High) with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, meaning exploitation is straightforward. The vulnerability allows attackers to compromise confidentiality, integrity, and availability through remote SQL injection attacks. The FAUCET Risk Score of 47.0 out of 100 indicates significant concern, though EPSS scoring suggests relatively low prevalence in active exploitation campaigns at this time. EXPLOITATION STATUS Exploit code for this vulnerability is publicly available, increasing the risk of opportunistic attacks. The vulnerability is listed on the active Hot List, signaling ongoing security community attention. No evidence indicates active widespread exploitation. The vendor was contacted early regarding disclosure but failed to respond, leaving users without official guidance or patches. Organizations running ProjectsAndPrograms School Management System should implement immediate mitigation measures including input validation, parameterized queries, or network-level access controls pending vendor response.