CVE-2026-6595
Published: 20 April 2026
Summary
CVE-2026-6595 is a medium-severity Injection (CWE-74) vulnerability in Feishu (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-6595 is a SQL injection vulnerability in the ProjectsAndPrograms School Management System up to commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59. It affects unknown code in the file buslocation.php within the HTTP GET Parameter Handler component, where manipulation of the bus_id argument triggers the issue. The vulnerability is classified under CWE-74 and CWE-89, with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
Any unauthenticated remote attacker can exploit this vulnerability by sending crafted HTTP GET requests with malicious bus_id values to the affected endpoint. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling data exfiltration, modification of database records, or denial of service, depending on the backend database configuration.
Advisories from VulDB and related sources, including recent disclosures, note that the product uses a rolling release model with no specific version details for affected or patched releases available. The vendor was contacted early but provided no response, leaving no official patches or mitigations documented in the provided references.
The exploit is publicly available and might be used in the wild, as highlighted in the disclosure published on 2026-04-20.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23743
Vulnerability details
A vulnerability was identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This vulnerability affects unknown code of the file buslocation.php of the component HTTP GET Parameter Handler. The manipulation of the argument bus_id leads to sql injection. It is…
more
possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote SQL injection vulnerability in a publicly accessible web application (buslocation.php via HTTP GET bus_id parameter) that can be exploited by unauthenticated attackers over the network, directly enabling T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of information inputs like the bus_id GET parameter in buslocation.php to directly prevent SQL injection manipulation.
SI-2 requires identification, prioritization, and correction of flaws such as the SQL injection vulnerability in buslocation.php up to commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59.
SI-4 enables monitoring of the system for indicators of SQL injection attacks exploiting the bus_id parameter via crafted HTTP GET requests.