CVE-2026-3261
Published: 26 February 2026
Summary
CVE-2026-3261 is a medium-severity Injection (CWE-74) vulnerability in Itsourcecode School Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-3261 is a SQL injection vulnerability in itsourcecode School Management System 1.0, affecting an unknown function in the file /settings/index.php within the Setting Handler component. The flaw arises from improper handling of the ID argument, allowing remote attackers to manipulate it and inject malicious SQL payloads. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via SQL injection. The exploit has been publicly released and is available for use.
Advisories referenced in VulDB entries (ctiid.347984, id.347984, submit.749364) document the issue, along with a GitHub issue at Ning-BJ/cve/issues/1 and the vendor site at itsourcecode.com. No specific patch or mitigation details are outlined in the available descriptions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8902
Vulnerability details
A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the component Setting Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely.…
more
The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a public-facing web application (School Management System) directly matches T1190 for initial access via exploitation of a network-reachable vulnerability with no authentication required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the ID input parameter in /settings/index.php, blocking the malicious SQL payloads that cause CVE-2026-3261.
Boundary protection devices such as WAFs or IPS can inspect and block SQL injection attempts targeting the Setting Handler before they reach the application.
Least-privilege database accounts limit the data exposure and modification possible even if an attacker successfully injects SQL via the vulnerable ID parameter.