Unpatched SQLi in School Management System Puts Student Data at Risk

The National Vulnerability Database (NVD) has detailed CVE-2026-6595, a high-severity SQL injection vulnerability affecting the ProjectsAndPrograms School Management System. Specifically, the flaw resides in the buslocation.php component, where manipulating the bus_id HTTP GET parameter allows for remote SQL injection. This isn’t theoretical; an exploit is publicly available, meaning attackers are likely already leveraging it.

This vulnerability, with a CVSS score of 7.3, allows for potential compromise of confidentiality, integrity, and availability. The vendor’s lack of response to early disclosure is concerning, especially since the product uses a rolling release model, making version tracking difficult for defenders. This leaves educational institutions using this system in a precarious position, potentially exposing sensitive student and operational data.

For CISOs in education, this is a direct threat. The ease of exploitation via a publicly available exploit, coupled with the vendor’s silence, means immediate action is required. This isn’t just about a bus route; it’s about student records, financial information, and potentially staff data. The attacker’s calculus here is simple: low effort, high reward, especially against targets that often lack robust security teams.