CRITICAL 9.1 NVD
CVE-2026-51346
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive informa
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.
References
- https://gitlab.studip.de/studip/studip/-/releases/v6.0.3
- https://simon.hilchenba.ch/blog/studip-sql-injection/
- https://simon.hilchenba.ch/blog/studip-sql-injection/
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-08-17 via NVD.
Risk Timeline
CVE Disclosed2026-08-17 · -1 days ago
Remediation Resources
Official Advisory
gitlab.studip.de/studip/studip/-/releases/v6.0.3Analysis & PoC
simon.hilchenba.ch/blog/studip-sql-injection/Analysis & PoC
simon.hilchenba.ch/blog/studip-sql-injection/
vulnfeed aggregates 11030 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.