CVE-2026-90516: SourceCodester School Registration and Fee System pay_report.php sql injection
A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/payreport.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for assessment?
Deployments of SourceCodester School Registration and Fee System version 1.0 should be prioritized, particularly where the affected pay_report.php endpoint is remotely reachable.
Does exploitation require authentication or user interaction?
No. The vulnerability is rated with no privileges required and no user interaction required, and the attack can be initiated remotely.
How could successful exploitation affect the application?
Successful SQL injection may result in limited impact to confidentiality, integrity, and availability. A public exploit is available, increasing the likelihood of attempted exploitation.