School-Management-System public search SQL injection

A school management web app can be hacked through its login form.

Summary

A SQL injection flaw in the Public Search Feature (parent_Login.php) of sumiie24's School-Management-System lets a remote attacker manipulate the email argument. Exploit code has been published.

What to do

No fixed version is named in the sources. The vendor did not respond, so check that the code is newer than commit d946d649c7c95e101fc5679ecd91999533bb10d7, and do not leave the app open to the internet.

Products and platforms

School-Management-System

CVE IDs

CVE-2026-121524 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 21:30 UTC

First seen 2026-11-09 15:20 UTC