Loading story…
Security researchers identified critical vulnerabilities in educational institution web applications, enabling unauthorized access to sensitive student data. In one case, a penetration tester discovered a SQL injection flaw in an educational website's receipt download endpoint, which allowed the attacker to enumerate university numbers, exploit the vulnerability using sqlmap, and ultimately dump the database containing personally identifiable information (PII) of students. Attempts to escalate the attack to an OS shell were unsuccessful due to insufficient permissions, but the exposure of student records highlights the severity of the flaw.
Another incident involved a manual penetration test against a major university's web infrastructure, where the tester bypassed automated tools and used manual techniques to identify and exploit weaknesses in a subdomain's registration functionality. The attacker was able to register as a non-member, receive verification codes, and gain deeper access, demonstrating the risks posed by insufficient input validation and weak authentication mechanisms in academic environments. These incidents underscore the ongoing threat of SQL injection and the need for robust security controls in educational sector web applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A separate write-up reported that an SQL injection issue led to a dump of student personally identifiable information. The available metadata does not specify the affected institution, discovery date, or any response actions.
A write-up describing the compromise of IIT Delhi was published, indicating the underlying security incident or testing activity had already occurred. No specific attack date, impact details, or remediation timeline are provided in the reference metadata.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **high-severity SQL injection** vulnerability was disclosed in Clickedu’s SaaS education management platform, tracked as **CVE-2026-2247** (CVSS v4.0 **8.3**, **CWE-89**). The issue occurs in the student report-card/bulletin generation workflow: after a user downloads a student’s report card from the *“Day-to-day”* section in the mobile app, a PDF URL is generated where the session token **does not expire** and remains valid for days. A remote attacker who is **previously authenticated** can append unusual characters after the `id_alu` parameter in that PDF URL to trigger **boolean-based blind** and **time-based blind** SQLi, potentially enabling access to sensitive database information. INCIBE-CERT reported that Clickedu has **remediated** the issue in an integration released on **2026-01-26**. Other disclosures in the same reporting stream—**multiple vulnerabilities in Graylog** (including a critical issue and several XSS findings) and **multiple/stored XSS vulnerabilities in Kubysoft** (e.g., SVG upload sanitization leading to stored script execution)—are separate advisories affecting different products and CVEs, and are not part of the Clickedu SQLi event.
Jun 29, 2026
Security researchers have detailed real-world exploitation techniques used to identify and leverage vulnerabilities in web applications, focusing on bug bounty scenarios. One researcher described successfully exploiting a path traversal vulnerability in a company's file upload functionality, allowing arbitrary file overwrites and folder creation by manipulating file save locations. Additional attempts were made to exploit content-type handling and CSV injection, though system command execution was not achieved in that case. Another researcher demonstrated the use of UNION-based SQL injection to enumerate database tables, extract credential columns, and ultimately dump usernames and passwords from a non-Oracle database. By exploiting a vulnerable product category filter, the attacker was able to gain administrator access, highlighting the risk of improperly sanitized user input in web applications. Both cases underscore the importance of secure coding practices and thorough application testing to prevent such vulnerabilities from being exploited in the wild.
Jun 29, 2026
Security researchers and bug bounty hunters have demonstrated how poor web application security practices can lead to unauthorized access or privilege escalation. In one case, a username hardcoded in the website's source code enabled an attacker to attempt account takeover by guessing passwords and analyzing server responses. Another incident involved an application that inadvertently granted admin access due to misconfigured access controls, discovered through reconnaissance techniques such as analyzing `sitemap.xml` and automated subdomain enumeration. These findings highlight the risks of exposing sensitive information in client-side code and the dangers of insufficient access control mechanisms. Attackers can exploit such weaknesses using simple tools and methods, emphasizing the need for secure coding practices, thorough code reviews, and regular security testing to prevent unauthorized access and privilege escalation in web applications.
Jul 12, 2026