EUVD-2026-34022
GHSA-4849-p72j-5rw9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed application instance
-
DeliverySend unauthenticated HTTP request to protected endpoint
-
ExploitAuthentication check bypassed due to CWE-287 flaw
-
ExecutionAccess student records or administrative functions
-
ImpactModify or exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of sayan365 Student Management System. The CVSS 4.0 vector explicitly confirms PR:N (no privileges required), AC:L (low attack complexity), AT:N (no attack requirements), and AV:N (network-accessible), meaning any network-reachable deployment is vulnerable without requiring specific feature flags, non-default settings, or user interaction. Multiple endpoints are affected, so the bypass is not gated behind a single optional feature. The sole limiting factor is network reachability: the application must be accessible from the attacker's network. There is no required user interaction, no OS or platform dependency, and no non-default configuration prerequisite identified in the available data. |
| Impact | The CVSS 4.0 base score of 5.5 (Medium) is driven by low Confidentiality, Integrity, and Availability impact values (VC:L/VI:L/VA:L), which tempers the score despite the highly permissive attack vector (AV:N/AC:L/AT:N/PR:N/UI:N). In practical terms, the exploitation path is as straightforward as possible: no authentication, no complexity, no user interaction, network-reachable. The CVSS E:P (Proof-of-Concept exploit available) modifier is set and aligns with the confirmed public exploit on GitHub, raising real-world risk above what the numeric score alone suggests. This is not a high-CVSS-but-low-real-risk issue - the combination of trivial unauthenticated network access, multiple affected endpoints, a public exploit, and an unresponsive maintainer with no patch creates meaningful operational exposure. The vulnerability is not listed in CISA KEV, so confirmed widespread exploitation has not been reported, but the low barrier to exploitation means that gap could close quickly. EPSS score was not provided in the input data and cannot be stated with confidence. |
| Exploit ScenarioDerived | An attacker scans for internet-accessible instances of the student-management-system using the public exploit code referenced in GitHub issue #4, then sends crafted unauthenticated HTTP requests directly to protected administrative or student-record endpoints, bypassing authentication entirely. Because attack complexity is low and no user interaction is required, this process can be automated against multiple targets simultaneously. The attacker gains read and write access to student records, grades, or administrative functions depending on which endpoints are reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthenticated attackers, allowing unauthorized access to application functionality across the entire codebase up to commit 7f3c9ce7d410332335c2affac93a385485051800. The CVSS 4.0 vector confirms trivial, unauthenticated network exploitation (AV:N/AC:L/AT:N/PR:N/UI:N), and publicly available exploit code exists per the E:P maturity modifier and GitHub issue #4. The maintainer has not responded to responsible disclosure, leaving no patch available and the exploit window open indefinitely.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the responsible disclosure filed via GitHub issues #3 and #4 (https://github.com/sayan365/student-management-system/issues/3). As an immediate compensating control, deployments should be placed behind network-layer or web server-level authentication (e.g., HTTP Basic Auth enforced via Apache or nginx configuration) to require credentials before any request reaches the application, which neutralizes the bypass without modifying application code. Firewall rules restricting application access to known trusted IP ranges provide an additional layer, though this may not be practical for broadly used deployments. If the application serves an internal audience, removing it from public internet exposure is the most effective risk reduction. Organizations should monitor the GitHub repository at https://github.com/sayan365/student-management-system for any upstream commits addressing authentication logic. Given the lack of maintainer engagement and the public exploit, decommissioning the application in favor of a maintained alternative is advisable for any environment where student data carries compliance obligations.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the sayan365/student-management-system PHP web application hosted on GitHub and distributed via rolling release, meaning no discrete version tags exist (CPE: cpe:2.3:a:sayan365:student-management-system:*:*:*:*:*:*:*:*). CWE-287 (Improper Authentication) identifies the root cause as a failure to correctly verify user identity before granting access to protected resources. The fact that multiple endpoints are affected - rather than a single isolated function - points to a systemic flaw in the application's authentication logic, such as missing or bypassable session/token validation applied inconsistently across routes. This class of vulnerability typically arises from direct object access without session checks, predictable token schemes, or authentication gates applied only at the login entry point but not enforced on downstream endpoints.
Know when Student Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Student Management System
View allA vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (
phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata
A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severi
A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium seve
Time-based blind SQL injection in krishanmurariji Student Management System 1.0 lets an attacker who can reach the /stud
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severi
A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerab
Authorization bypass in ningzichun's student-management-system (all versions up to commit 98760f5711cf6dc8b4adca53a9e207
Authorization bypass in ningzichun student-management-system (versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b0
Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to rem
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands vi
Exploit-DB