Is there a public PoC exploit available for CVE-2026-10168?

Yes, a public proof-of-concept exploit is available for CVE-2026-10168. Prioritise patching immediately. EPSS: 0.0%.

School Student Management System CVE-2026-10168

Q: What is the CVSS score of CVE-2026-10168?

CVE-2026-10168 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33488 LOW

Improper Control of Resource Identifiers ('Resource Injection') (CWE-99)

2026-05-31 VulDB

GHSA-qxc5-j6gp-6g2h

Information Disclosure PHP School Student Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 31, 2026 - 05:29 vuln.today

Severity Changed

May 31, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 31, 2026 - 05:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Affected is the function marks of the file application/controllers/Parents.php. The manipulation of the argument param1 leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Resource injection in the OUSL-GROUP-BrinaryBrains School Student Management System allows authenticated remote attackers to manipulate the param1 argument in the marks function of Parents.php, improperly controlling resource identifiers to access unauthorized academic records. The CVSS 4.0 score is 2.1, reflecting low-privilege authentication requirements (PR:L) and limited scope impact; a publicly available proof-of-concept exploit has been disclosed via a GitHub issue. No vendor patch exists - the project uses continuous delivery rolling releases and has not responded to the responsible disclosure report.

Technical ContextAI

CWE-99 (Improper Control of Resource Identifiers) describes a class of vulnerability where attacker-supplied input is used to construct or resolve resource references - such as database record IDs, file paths, or object references - without adequate authorization checks. In this PHP web application, the marks function within application/controllers/Parents.php accepts a param1 argument that is used to retrieve student academic marks data. The application fails to validate that the resolved resource identifier belongs to the authenticated user's associated student records, making this effectively an Insecure Direct Object Reference (IDOR) pattern. The affected product is identified by CPE cpe:2.3:a:ousl-group-brinarybrains:school_student_management_system:*:*:*:*:*:*:*:*, indicating all tracked versions of this PHP-based school administration platform are affected.

RemediationAI

No vendor-released patch has been identified at time of analysis. The project was notified via responsible disclosure through GitHub issue #25 (https://github.com/OUSL-GROUP-BrinaryBrains/School-Student-Management-System/issues/25) but has not responded. Administrators should immediately apply authorization checks within the marks function in application/controllers/Parents.php, enforcing that any resource identifier passed via param1 is verified to belong to the authenticated user's associated student account before data is returned - rejecting or returning an error for any mismatched identifiers. If the application cannot be patched promptly, restricting access to the Parents module to internal networks only will reduce the attack surface, at the trade-off of preventing legitimate remote parent access. Input validation on param1 to reject non-numeric or out-of-range values will further reduce exploitation surface. Monitor VulDB entry https://vuldb.com/vuln/367422 and the upstream GitHub repository for any future vendor response or patch release.