Cyber Resilience

CVE-2026-3760

MediumPublic PoC

Published: 08 March 2026

Published
08 March 2026
Modified
09 March 2026
KEV Added
—
Patch
—
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0039 30.7th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-3760 is a medium-severity Injection (CWE-74) vulnerability in Angeljudesuarez University Management System. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-3760 is a SQL injection vulnerability (CWE-74, CWE-89) in itsourcecode University Management System 1.0. The issue affects unknown code in the file /view_result.php, where manipulation of the 'seme' argument triggers the injection.

The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), allowing remote attackers with no privileges or user interaction to exploit it over the network with low complexity. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability. The exploit is public and may be used.

Advisories and further details are documented in VulDB entries (ctiid.349738, id.349738, submit.768095), a GitHub issue at Rsansan/security-monitor #1, and the vendor site itsourcecode.com. No specific patches or mitigations are detailed in the CVE description.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

A vulnerability was detected in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /view_result.php. Performing a manipulation of the argument seme results in sql injection. The attack is possible to be carried out remotely. The…

more

exploit is now public and may be used.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in unauthenticated public-facing web app (/view_result.php) directly enables remote exploitation for initial access (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-3740Same product: Angeljudesuarez University Management System
CVE-2026-3747Same product: Angeljudesuarez University Management System
CVE-2026-3944Same product: Angeljudesuarez University Management System
CVE-2026-3765Same product: Angeljudesuarez University Management System
CVE-2026-3413Same product: Angeljudesuarez University Management System
CVE-2026-3411Same product: Angeljudesuarez University Management System
CVE-2026-2116Same vendor: Angeljudesuarez
CVE-2026-1589Same vendor: Angeljudesuarez
CVE-2026-1118Same vendor: Angeljudesuarez
CVE-2026-2117Same vendor: Angeljudesuarez

Affected Assets

angeljudesuarez
university management system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of the 'seme' input parameter to reject malformed SQL syntax before it reaches the database.

AC-6 Least Privilege partial match
prevent

Limits the privileges of the database account used by view_result.php so a successful injection cannot read or modify arbitrary data.

SI-4 System Monitoring partial match
detect

Enables monitoring and alerting on anomalous SQL statements or error patterns originating from /view_result.php.

References