Loading story…
A high-severity SQL injection vulnerability was disclosed in Clickedu’s SaaS education management platform, tracked as CVE-2026-2247 (CVSS v4.0 8.3, CWE-89). The issue occurs in the student report-card/bulletin generation workflow: after a user downloads a student’s report card from the “Day-to-day” section in the mobile app, a PDF URL is generated where the session token does not expire and remains valid for days. A remote attacker who is previously authenticated can append unusual characters after the id_alu parameter in that PDF URL to trigger boolean-based blind and time-based blind SQLi, potentially enabling access to sensitive database information.
INCIBE-CERT reported that Clickedu has remediated the issue in an integration released on 2026-01-26. Other disclosures in the same reporting stream—multiple vulnerabilities in Graylog (including a critical issue and several XSS findings) and multiple/stored XSS vulnerabilities in Kubysoft (e.g., SVG upload sanitization leading to stored script execution)—are separate advisories affecting different products and CVEs, and are not part of the Clickedu SQLi event.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
INCIBE-CERT and CVE tracking disclosed CVE-2026-2247, a SQL injection flaw in Clickedu's SaaS platform affecting student report card generation. The issue allows an authenticated remote attacker to manipulate a PDF URL from the mobile app's "Day-to-day" section to perform blind SQL injection and potentially access confidential database information.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers identified critical vulnerabilities in educational institution web applications, enabling unauthorized access to sensitive student data. In one case, a penetration tester discovered a SQL injection flaw in an educational website's receipt download endpoint, which allowed the attacker to enumerate university numbers, exploit the vulnerability using `sqlmap`, and ultimately dump the database containing personally identifiable information (PII) of students. Attempts to escalate the attack to an OS shell were unsuccessful due to insufficient permissions, but the exposure of student records highlights the severity of the flaw. Another incident involved a manual penetration test against a major university's web infrastructure, where the tester bypassed automated tools and used manual techniques to identify and exploit weaknesses in a subdomain's registration functionality. The attacker was able to register as a non-member, receive verification codes, and gain deeper access, demonstrating the risks posed by insufficient input validation and weak authentication mechanisms in academic environments. These incidents underscore the ongoing threat of SQL injection and the need for robust security controls in educational sector web applications.
Jul 12, 2026
Several critical and high-severity vulnerabilities have been identified in Imaster's MEMS Events CRM and Patient Records Management System, including SQL injection and stored Cross-Site Scripting (XSS) flaws. The vulnerabilities, tracked as CVE-2025-41003, CVE-2025-41004, CVE-2025-41005, and CVE-2025-41006, were discovered by Gonzalo Aguilar García (6h4ack) and coordinated by INCIBE. Specifically, SQL injection vulnerabilities exist in the 'id' parameter of `/projects/hospital/admin/complaints.php` (CVE-2025-41004), the 'keyword' parameter of `/memsdemo/exchange_offers.php` (CVE-2025-41005), and the 'phone' parameter of `/memsdemo/login.php` (CVE-2025-41006`). Additionally, a stored XSS vulnerability (CVE-2025-41003) affects the 'firstname' parameter in `/projects/hospital/admin/edit_patient.php`. All vulnerabilities are remotely exploitable, with CVSS v4.0 base scores ranging from 5.1 (medium) to 9.3 (critical), and no patches have been reported as available. The vulnerabilities impact enterprise management software used for event and patient record management, posing significant risks of unauthorized access, data exfiltration, and potential compromise of sensitive information. The SQL injection flaws, in particular, allow attackers to execute arbitrary SQL commands, potentially leading to full database compromise. The stored XSS vulnerability enables the execution of arbitrary JavaScript in the context of affected users, increasing the risk of session hijacking and further exploitation. Organizations using Imaster's MEMS Events CRM or Patient Records Management System should urgently assess their exposure and implement compensating controls until official fixes are released.
Jun 29, 2026
MITRE has published two high-severity SQL injection vulnerabilities affecting widely available PHP-based management applications: **SourceCodester Payroll Management and Information System v1.0** and **CodeAstro Simple Attendance Management System v1.0**. The SourceCodester issue, tracked as `CVE-2026-37347`, affects `/payroll/view_employee.php` and is classified as `CWE-89`; its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` indicates remote exploitation with no privileges or user interaction required, with high impact to confidentiality and integrity. The CodeAstro flaw, `CVE-2026-37749`, is also a `CWE-89` SQL injection bug and affects `index.php`, where the `username` parameter can be abused by remote, unauthenticated attackers to bypass authentication. Its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` reflects high impact across confidentiality, integrity, and availability. Both CVE entries were updated with severity details and public references, including GitHub documentation, underscoring the exposure of internet-reachable administrative and employee-management functions to straightforward injection attacks.
Jun 29, 2026