Low severity · published Oct 18, 2026
CVE-2026-111993
Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 0% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
StudentManagement · Soarkey
e08f7f1d5015af407aa4cca0ada3dea189b4937e · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111993
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111993
github.com
https://github.com/Soarkey/StudentManagement/
github.com
https://github.com/Soarkey/StudentManagement/issues/36
vuldb.com
https://vuldb.com/cve/CVE-2026-111993
vuldb.com
https://vuldb.com/submit/1008019
vuldb.com
https://vuldb.com/vuln/421658
vuldb.com
https://vuldb.com/vuln/421658/cti
More from StudentManagement
7.3
CVE-2026-90787
Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management
7.3
CVE-2026-82621
Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization
6.3
CVE-2026-82620
Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection