What’s Vulnerable › Vulnerabilities

CVE-2026-5537: halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-05 · updated 2026-07-24
• Weakness: CWE-74

Description

A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the file Apps/Index/Controller/IndexController.class.php of the component HTTP GET Parameter Handler. The manipulation of the argument seid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• halex CourseSEL: 1.0, 1.1.0

References

• https://github.com/zy606/Vulnerability-Report/tree/main/CourseSEL-SQLi
• https://vuldb.com/submit/782202
• https://vuldb.com/vuln/355290
• https://vuldb.com/vuln/355290/cti

Get alerted when CVE-2026-5537 or the next vulnerability affects your stack