CVE-2026-5182
Published: 31 March 2026
Summary
CVE-2026-5182 is a medium-severity Injection (CWE-74) vulnerability in Sourcecodester (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5182 is a SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester Teacher Record System 1.0. The flaw impacts an unknown function within the Teacher Record System file of the Parameter Handler component, triggered by manipulation of the 'searchteacher' argument. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its remote exploitability.
Any unauthenticated remote attacker can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL payloads. A public exploit exists and could be used against vulnerable instances.
Advisories and further details are available via VulDB entries (https://vuldb.com/vuln/354250, https://vuldb.com/vuln/354250/cti, https://vuldb.com/submit/780379) and a GitHub issue (https://github.com/dyh1213-wq/cve/issues/6), along with the vendor site (https://www.sourcecodester.com/). No specific patch or mitigation guidance is detailed in the core vulnerability description.
The exploit has been made public, increasing the risk of active targeting for this Teacher Record System deployment.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17329
Vulnerability details
A vulnerability was found in SourceCodester Teacher Record System 1.0. Impacted is an unknown function of the file Teacher Record System of the component Parameter Handler. Performing a manipulation of the argument searchteacher results in sql injection. It is possible…
more
to initiate the attack remotely. The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app directly enables remote unauthenticated exploitation via T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection by enforcing validation of untrusted inputs like the 'searchteacher' parameter to prevent malicious SQL payload execution.
Requires timely identification, reporting, and correction of the specific SQL injection flaw in the Teacher Record System's Parameter Handler.
Enables monitoring of system activities to detect SQL injection attempts through anomalous database queries or unauthorized data access patterns.