CVE-2026-26694
Published: 02 March 2026
Summary
CVE-2026-26694 is a critical-severity SQL Injection (CWE-89) vulnerability in Carmelo Simple Student Alumni System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection in /TracerStudy/modal_view.php by requiring validation and sanitization of user-supplied inputs before database query construction.
Mandates identification, reporting, and correction of the specific SQL injection flaw in CVE-2026-26694 through systematic flaw remediation processes.
Limits the impact of successful SQL injection exploitation by enforcing least privilege on the application's database access accounts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated public-facing web app (/modal_view.php) directly maps to T1190 for remote exploitation; enables database access/modification/disruption per description, mapping to T1213.006.
NVD Description
code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php.
Deeper analysisAI
CVE-2026-26694 is a SQL injection vulnerability (CWE-89) in code-projects Simple Student Alumni System v1.0, specifically affecting the /TracerStudy/modal_view.php component. Published on 2026-03-02, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impacts.
The vulnerability enables remote exploitation over the network with low complexity, requiring no authentication privileges or user interaction. An unauthenticated attacker can inject malicious SQL payloads to compromise the underlying database, achieving high confidentiality, integrity, and availability impacts, such as extracting sensitive data, modifying records, or disrupting service.
Mitigation details are documented in the referenced advisory at https://github.com/Thirtypenny77/bug_report/blob/main/code-projects/simple-student-alumni-system/SQL-3.md.
Details
- CWE(s)