CVE-2026-6595

ProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection

State: Published
Severity: 6.9 Medium
Published: Apr 20, 2026
Updated: Apr 20, 2026
Reserved: Apr 19, 2026

Description

A vulnerability was identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This vulnerability affects unknown code of the file buslocation.php of the component HTTP GET Parameter Handler. The manipulation of the argument bus_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-89 SQL Injection
CWE-74 Injection

Affected Products

Product	Versions
School Management SystemProjectsAndPrograms	6b6fae5426044f89c08d0dd101c7fa71f9042a59Affected

References

VDB-358230 | ProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injectionvdb-entrytechnical-description
VDB-358230 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #791820 | ProjectsAndPrograms school-management-system commit 6b6fae5 SQL Injectionthird-party-advisory
https://tcn60zf28jhk.feishu.cn/wiki/MdHFw78Gmi1zbske8Ozc6XTjnIh?from=from_copylinkexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.