Cyber Resilience

CVE-2026-3767

MediumPublic PoC

Published: 08 March 2026

Published
08 March 2026
Modified
10 March 2026
KEV Added
Patch
CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0027 17.7th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-3767 is a medium-severity Injection (CWE-74) vulnerability in Angeljudesuarez College Management System. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2026-3767 is a SQL injection vulnerability (CWE-74, CWE-89) in itsourcecode sanitize or validate this input 1.0, affecting an unknown function within the file /admin/teacher-attendance.php. The issue stems from a failure to properly sanitize or validate the teacher_id input parameter, allowing malicious SQL payloads to be executed.

A remote attacker with low privileges (PR:L) can exploit the vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), without changing the scope (S:U). Successful exploitation leads to low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), as reflected in the CVSS 3.1 base score of 6.3.

Advisories and details are available via VulDB entries (https://vuldb.com/?ctiid.349745, https://vuldb.com/?id.349745, https://vuldb.com/?submit.768276) and a GitHub issue (https://github.com/ltranquility/cve_submit/issues/9), with the software source at https://itsourcecode.com/. No specific patch or mitigation guidance is detailed in the CVE description.

An exploit for this vulnerability has been made publicly available and could be used for attacks, as noted in the disclosure published on 2026-03-08.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A weakness has been identified in itsourcecode sanitize or validate this input 1.0. Affected is an unknown function of the file /admin/teacher-attendance.php. Executing a manipulation of the argument teacher_id can lead to sql injection. The attack may be launched remotely.…

more

The exploit has been made available to the public and could be used for attacks.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection in a remotely accessible web application (network attack vector, no user interaction required) directly enables remote exploitation of a public-facing or network-exposed application to achieve impacts on confidentiality/integrity/availability.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-3151Same product: Angeljudesuarez College Management System
CVE-2026-3150Same product: Angeljudesuarez College Management System
CVE-2026-3152Same product: Angeljudesuarez College Management System
CVE-2026-3149Same product: Angeljudesuarez College Management System
CVE-2026-3487Same product: Angeljudesuarez College Management System
CVE-2026-3486Same product: Angeljudesuarez College Management System
CVE-2026-2116Same vendor: Angeljudesuarez
CVE-2026-1589Same vendor: Angeljudesuarez
CVE-2026-3740Same vendor: Angeljudesuarez
CVE-2026-1118Same vendor: Angeljudesuarez

Affected Assets

angeljudesuarez
college management system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of all inputs (such as teacher_id) to reject malformed or malicious data before it reaches SQL statements.

prevent

Enforces that only authorized, intended operations are performed on the database, blocking the unauthorized SQL commands injected via the unsanitized parameter.

detect

Enables monitoring and analysis of application and database activity to identify anomalous queries or error patterns indicative of SQL injection attempts against teacher-attendance.php.

References