Student-Management-System CVE-2026-10271

The attacker must be able to reach the admin/ endpoint over the network (AV:N, AC:L). Per the CVSS PR:N vector, no authentication or account credentials are required. UI:R indicates some form of user interaction is needed - in the EAR context this is most plausibly satisfied by the attacker's own deliberate non-following of the redirect (i.e., capturing the raw response body), which is a trivial technical action, or alternatively by a social-engineering step targeting an authenticated admin user. Exploitation requires the application to be deployed and publicly accessible; institutions that have restricted admin/ to internal networks or behind a VPN are not directly exploitable remotely. The uid parameter must be supplied and manipulable, which the CVE description confirms is the case across multiple endpoints. Exploitation is limited by: the UI:R interaction requirement, the narrow academic deployment context, and the partial (Low) impact across confidentiality, integrity, and availability rather than full system compromise.

The CVSS 6.3 Medium score is composed of AV:N (network exploitable), AC:L (low complexity), PR:N (no authentication required), UI:R (user interaction required), and partial C/I/A impacts. The UI:R requirement is the primary mitigating factor - it implies either social engineering of an admin user or that the redirect interaction itself constitutes the required user action, which in EAR vulnerabilities is often trivially satisfied by simply not following the redirect. The temporal metric E:P confirms a proof-of-concept is publicly available via GitHub issue #2, lowering the bar for exploitation. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. KEV status is not confirmed, and no active exploitation has been attributed. The niche deployment context (academic institutions running this specific open-source PHP project) materially limits the population of reachable targets, moderating real-world risk below what PR:N alone suggests. The rolling release model with no version tagging means there is no safe version to upgrade to - all deployments are affected by default.

A public exploit exists, published via GitHub issue #2. An attacker sends a crafted HTTP GET or POST request directly to the admin/ endpoint with a manipulated uid parameter value, without following the resulting 302 redirect; an HTTP client configured to capture raw responses (e.g., curl --max-redirs 0) receives the full response body containing admin-accessible student records or system data despite the redirect header. Because no authentication is required per the PR:N CVSS vector, the attacker requires only network access to the application.