CVE-2026-90849: SourceCodester College Notes Gallery Management System login.php sql injection
A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction, according to the supplied vector. Public exploit disclosure increases the likelihood that unauthenticated attackers may attempt exploitation.
Which input should be investigated?
The affected functionality is in /College/login.php, where manipulation of the User argument leads to SQL injection. Review application logs and request telemetry for suspicious or malformed values supplied to that parameter.
Is there a known fixed version or workaround?
The provided data identifies version 1.0 as affected but does not provide a fixed release or workaround. If patching information is unavailable, prioritize restricting access to the affected login endpoint and investigate requests targeting the User argument.