Is there a public PoC exploit available for CVE-2026-10619?

Yes, a public proof-of-concept exploit is available for CVE-2026-10619. Prioritise patching immediately. EPSS: 0.1%.

Student Management System CVE-2026-10619

Q: What is the CVSS score of CVE-2026-10619?

CVE-2026-10619 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34022 MEDIUM

Improper Authentication (CWE-287)

2026-06-02 VulDB

GHSA-4849-p72j-5rw9

Authentication Bypass Student Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 21:23 vuln.today

Severity Changed

Jun 02, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Jun 02, 2026 - 21:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthenticated attackers, allowing unauthorized access to application functionality across the entire codebase up to commit 7f3c9ce7d410332335c2affac93a385485051800. The CVSS 4.0 vector confirms trivial, unauthenticated network exploitation (AV:N/AC:L/AT:N/PR:N/UI:N), and publicly available exploit code exists per the E:P maturity modifier and GitHub issue #4. The maintainer has not responded to responsible disclosure, leaving no patch available and the exploit window open indefinitely.

Technical ContextAI

The affected product is the sayan365/student-management-system PHP web application hosted on GitHub and distributed via rolling release, meaning no discrete version tags exist (CPE: cpe:2.3:a:sayan365:student-management-system:*:*:*:*:*:*:*:*). CWE-287 (Improper Authentication) identifies the root cause as a failure to correctly verify user identity before granting access to protected resources. The fact that multiple endpoints are affected - rather than a single isolated function - points to a systemic flaw in the application's authentication logic, such as missing or bypassable session/token validation applied inconsistently across routes. This class of vulnerability typically arises from direct object access without session checks, predictable token schemes, or authentication gates applied only at the login entry point but not enforced on downstream endpoints.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the responsible disclosure filed via GitHub issues #3 and #4 (https://github.com/sayan365/student-management-system/issues/3). As an immediate compensating control, deployments should be placed behind network-layer or web server-level authentication (e.g., HTTP Basic Auth enforced via Apache or nginx configuration) to require credentials before any request reaches the application, which neutralizes the bypass without modifying application code. Firewall rules restricting application access to known trusted IP ranges provide an additional layer, though this may not be practical for broadly used deployments. If the application serves an internal audience, removing it from public internet exposure is the most effective risk reduction. Organizations should monitor the GitHub repository at https://github.com/sayan365/student-management-system for any upstream commits addressing authentication logic. Given the lack of maintainer engagement and the public exploit, decommissioning the application in favor of a maintained alternative is advisable for any environment where student data carries compliance obligations.