CVE-2014-1636

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow...

7.5 HighPublic exploit

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.

Exploit likelihood

3.80%Down 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2014-1636
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-1636
Updated: 2026-11-02

EUVDEUVD-2014-1710 No score

Record: EUVD-2014-1710
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g5qc-mxg3-w44r No score

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow...

Record: GHSA-g5qc-mxg3-w44r
Weakness: CWE-89
Updated: 2026-11-02

Affected products

doug poulin command school student management system

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Command School Student Management System - '/sw/admin_grades.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_terms.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_school_years.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_sgrades.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_media_codes_1.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_infraction_codes.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_generations.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_relations.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_titles.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/health_allergies.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_school_names.php?id' SQL Injection	2014-01-07
Exploit-DB	Command School Student Management System - '/sw/admin_subjects.php?id' SQL Injection	2014-01-07

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-1636 is a high vulnerability (CVSS 7.5) in Doug Poulin Command School Student Management System, published January 22, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.80%, the 90th percentile. No source names a fixed version.

References

Show 11 moreShow less