EUVD-2026-33661
GHSA-4hpq-vmjj-ghvx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an unknown function of the file admin/deleteform.php. Such manipulation of the argument sid leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Improper authorization in a4m4's Student-Management-System allows unauthenticated remote attackers to manipulate the sid parameter in admin/deleteform.php to delete student records without any credentials. All commits up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0 are affected, and a proof-of-concept exploit has been publicly disclosed via the project's GitHub issue tracker. No patch is available; the maintainer has not responded to the responsible disclosure report, leaving all deployed instances exposed with no official remediation path.
Technical ContextAI
The affected application is a PHP-based Student Management System (CPE: cpe:2.3:a:a4m4:student-management-system:*:*:*:*:*:*:*:*) available on GitHub under a4m4/Student-Management-System--PHP-. The vulnerable component is the administrative endpoint admin/deleteform.php, which accepts a sid (student ID) parameter and performs a database delete operation without first verifying whether the requesting client holds an active, authorized admin session. CWE-285 (Improper Authorization) identifies the root cause as a failure to enforce access control at the function level - the application either omits the authorization gate entirely on this endpoint or implements it incorrectly, meaning the deletion action is reachable without passing any authentication check. The CVSS 4.0 vector confirms no additional tactics (AT:N), no privileges (PR:N), and no user interaction (UI:N) are required, consistent with a direct, unguarded administrative endpoint exposed over the network.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the GitHub issue disclosure (https://github.com/a4m4/Student-Management-System--PHP-/issues/3). As an immediate compensating control, restrict access to admin/deleteform.php at the web server layer - for Apache, use an .htaccess directive requiring valid authenticated sessions before the PHP script is reached; for nginx, use a location block with auth_basic or IP allowlisting to limit access to known administrator source addresses. Trade-off: IP allowlisting breaks legitimate remote admin access. Alternatively, insert a PHP session validation check at the top of deleteform.php to verify an active admin session exists before processing the sid parameter - this directly addresses the CWE-285 root cause and has no functional side effects for legitimate admins. Removing or renaming the file entirely will prevent exploitation but disables the student deletion feature. Monitor https://vuldb.com/vuln/367551 and the GitHub repository for any upstream fix commit.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today