Student-Management-System CVE-2026-10777

No special conditions are required - remote unauthenticated exploitation is possible against default configurations of Student-Management-System, as confirmed by the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). The sole deployment prerequisite is that the application's admin/config.php endpoint is reachable from the attacker's network (i.e., the /admin/ path is not blocked by a firewall or web server access control). No authentication, no user interaction, no non-default configuration, and no specific platform condition is required. Exploitation is limited to the application layer - the CVSS scope components (SC:N/SI:N/SA:N) indicate the attacker is constrained to the web application's own data and functionality and cannot directly compromise the underlying operating system or adjacent services through this flaw alone.

The CVSS 4.0 score of 5.5 (Medium) reflects network-accessible, zero-complexity, unauthenticated exploitation but with limited impact scope: confidentiality, integrity, and availability impacts are all rated Low (VC:L/VI:L/VA:L), and there is no scope change to subsequent system components (SC:N/SI:N/SA:N). This constrains the blast radius to the application layer. However, two signals elevate real-world priority above the medium score: first, the E:P (Exploit Maturity: Proof of Concept) modifier confirms functional exploit code is publicly accessible, dramatically lowering attacker skill requirements; second, the vendor has not responded to disclosure, meaning there is no patch timeline. No EPSS score was provided in the input data - this gap should be filled before finalizing prioritization. No CISA KEV listing exists, so widespread active exploitation is not confirmed, but the combination of a trivially exploitable auth bypass, public POC, and unpatched state in a student records system (which likely holds PII) creates meaningful real-world risk for any internet-exposed deployment. The limited CVSS impact scores should not be used as the sole triage signal here.

An unauthenticated remote attacker identifies an internet-exposed Student-Management-System instance and sends a crafted HTTP request directly to the admin/config.php endpoint, exploiting the authentication bypass to gain access to the administrative backend without credentials. Using the publicly available proof-of-concept exploit documented in GitHub issue #2, the attacker can enumerate student records, exfiltrate PII, or modify system configuration. No special tooling or elevated skill is required given the low attack complexity (AC:L) and absence of prerequisites.