Student-Management-System CVE-2026-10272

The admin/deleteform.php endpoint must be reachable over the network - the CVSS vector (AV:N/PR:N/UI:N) confirms no authentication is required and no user interaction is needed. The attacker must supply a valid or guessable sid value corresponding to an existing student record; sequential integer IDs are common in PHP academic projects and are trivially enumerable. Exploitation is limited by: the restricted impact ceiling (record deletion only - no code execution, no credential exposure, no lateral movement to adjacent systems per SC:N/SI:N/SA:N); the non-default scenario of the admin panel being internet-exposed rather than restricted to internal networks; and the requirement that the target application is running on a live PHP-capable web server. No special non-default configuration is required - default deployments are vulnerable if network-accessible.

The CVSS 4.0 base score of 5.5 (Medium) reflects a network-accessible, unauthenticated attack (AV:N/AC:L/PR:N/UI:N) with limited impact: low integrity loss (VI:L) and low availability impact (VA:L) with no confidentiality exposure (VC:N) and no scope change to adjacent systems. The E:P supplemental metric confirms a working proof-of-concept exists, which meaningfully lowers the bar for exploitation. No EPSS score was provided in the input data, so exploitation probability cannot be quantified independently. The vulnerability is not listed in the CISA KEV catalog, meaning confirmed active exploitation in the wild has not been established. Real-world priority is tempered by the narrow impact ceiling - this grants record deletion capability only, not code execution or credential theft - and by the likely limited, non-internet-facing deployment profile of an open-source academic PHP project. However, the complete absence of a patch and an unresponsive maintainer mean the exposure window is indefinite for any deployed instance. The combination of public PoC plus no patch is the primary risk amplifier here, not the CVSS score alone.

An attacker identifies a publicly accessible instance of the Student-Management-System and sends a crafted HTTP request directly to admin/deleteform.php with a valid or enumerated sid value (e.g., GET /admin/deleteform.php?sid=42). Because the endpoint performs no session or authorization check, the database deletion executes immediately without credentials. With the public PoC available via the GitHub issue tracker, exploitation requires minimal skill and can be scripted to iterate over student IDs, bulk-deleting records.