Is there a public PoC exploit available for CVE-2026-10777?

Yes, a public proof-of-concept exploit is available for CVE-2026-10777. Prioritise patching immediately. EPSS: 0.1%.

Student-Management-System CVE-2026-10777

Q: What is the CVSS score of CVE-2026-10777?

CVE-2026-10777 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34186 MEDIUM

Improper Authentication (CWE-287)

2026-06-03 VulDB

GHSA-j7p7-p844-3j69

PHP Authentication Bypass Student Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 23:31 vuln.today

Severity Changed

Jun 03, 2026 - 23:22 NVD

HIGH MEDIUM

CVSS changed

Jun 03, 2026 - 23:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to remote unauthenticated attackers via a flaw in admin/config.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero prerequisites - no privileges, no user interaction, no special attack conditions - and a proof-of-concept exploit is publicly available via a GitHub issue report. The vendor has not responded to responsible disclosure and no patched release has been issued, leaving all deployments at or before commit 01451bd7a2f58cdda07bd0b86e3967582e3ecd08 without an official remediation path.

Technical ContextAI

Student-Management-System is a PHP-based web application developed by ealpha072 (CPE: cpe:2.3:a:ealpha072:student-management-system:*:*:*:*:*:*:*:*) designed to manage student records through an administrative backend. The vulnerability resides in admin/config.php, a file typically responsible for authentication bootstrapping, session initialization, or access control gating in PHP applications. CWE-287 (Improper Authentication) identifies the root cause class: the application either fails to enforce credential verification on this endpoint, skips authentication checks via a logic flaw, or accepts manipulated input that circumvents the auth guard. In PHP applications, this pattern commonly manifests as missing session_start() checks, absent require() calls for auth includes, or conditional logic that can be bypassed by manipulating request parameters or cookies. The rolling-release delivery model means no formal version tags exist, making patch identification dependent on commit-level tracking.

RemediationAI

No vendor-released patch has been identified at time of analysis, and the vendor has not responded to the disclosure. As an immediate compensating control, restrict network access to the /admin/ directory using web server access controls - for Apache, add a Require ip directive in .htaccess to limit access to trusted IP ranges; for nginx, use an allow/deny block on the /admin location. Note that this breaks legitimate admin access from non-allowlisted IPs and requires maintaining an up-to-date allowlist. As a code-level interim fix, add an explicit PHP session authentication check at the top of admin/config.php (e.g., verifying a session variable set only after successful login and redirecting unauthenticated requests) - this requires code modification and testing. Do not expose this application to the public internet without one of these controls in place. Monitor the GitHub repository (https://github.com/ealpha072/Student-Management-System/) and the VulDB entry (https://vuldb.com/vuln/368139) for any upstream commits that address the issue. Organizations managing sensitive student PII should evaluate whether to replace or fork this project given the vendor's lack of response.