CVE-2026-7545
Published: 01 May 2026
Summary
CVE-2026-7545 is a medium-severity Injection (CWE-74) vulnerability in Sourcecodester (inferred from references). Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7545 is a SQL injection vulnerability (CWE-74, CWE-89) affecting SourceCodester Advanced School Management System 1.0, published on 2026-05-01. The weakness resides in an unknown function within the file commonController.php of the checkEmail Endpoint component, where improper input handling allows manipulation leading to SQL injection.
The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), enabling remote attackers with no privileges or user interaction to exploit it over the network with low complexity. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL queries.
Advisories and additional details are available at https://github.com/eqwerwq/CVE/issues/2, https://vuldb.com/submit/804340, https://vuldb.com/vuln/360356, https://vuldb.com/vuln/360356/cti, and https://www.sourcecodester.com/. A public exploit is available, increasing the risk of attacks against exposed instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26471
Vulnerability details
A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the component checkEmail Endpoint. This manipulation causes sql injection. Remote exploitation of the attack is possible.…
more
The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (checkEmail endpoint) directly enables T1190: Exploit Public-Facing Application for remote unauthenticated access and data manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by enforcing input validation and error handling at the checkEmail endpoint in commonController.php where improper input handling allows malicious SQL queries.
Addresses the specific SQL injection flaw through timely identification, reporting, and remediation such as vendor patches for the vulnerable Advanced School Management System.
Mitigates remote SQL injection exploitation by monitoring and controlling communications at external interfaces, such as via web application firewalls blocking injection payloads.