Is there a public PoC exploit available for CVE-2026-10815?

Yes, a public proof-of-concept exploit is available for CVE-2026-10815. Prioritise patching immediately. EPSS: 0.0%.

Hostel Management System CVE-2026-10815

Q: What is the CVSS score of CVE-2026-10815?

CVE-2026-10815 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34293 LOW

Missing Authorization (CWE-862)

2026-06-04 VulDB

GHSA-j6g4-hg9x-qfvx

PHP Authentication Bypass Hostel Management System Php

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 04, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jun 04, 2026 - 16:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 04, 2026 - 16:19 vuln.today

DescriptionCVE.org

A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects some unknown processing of the file hostel/index.php of the component Admin Dashboard Page. The manipulation of the argument ID results in missing authorization. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Missing authorization on the Admin Dashboard endpoint of LakshayD02's Hostel-Management-System-PHP allows low-privileged authenticated users to manipulate the ID parameter in hostel/index.php to access or modify records beyond their permitted scope. All commits up to f87e67c283bab6f718faf2fec6ae39a13bd7036b are affected; the project uses no formal versioning, so no unaffected release exists. Publicly available exploit code exists, and the project maintainer had not responded to coordinated disclosure at time of reporting.

Technical ContextAI

The affected software is a PHP-based hostel management web application identified by CPE cpe:2.3:a:lakshayd02:hostel-management-system-php:*:*:*:*:*:*:*:*, hosted on GitHub without formal version tagging. The root cause is CWE-862 (Missing Authorization): the server-side PHP code in hostel/index.php processes the user-supplied ID parameter without verifying whether the requesting authenticated session holds sufficient privilege to act on the referenced object. This is a classic Insecure Direct Object Reference (IDOR) pattern - the application authenticates the user but fails to authorize per-object access, allowing horizontal or vertical privilege escalation against data records managed by the Admin Dashboard component.

RemediationAI

No vendor-released patch has been identified at time of analysis - the upstream maintainer had not responded to the GitHub issue disclosure (https://github.com/LakshayD02/Hostel-Management-System-PHP/issues/1). The most effective immediate compensating control is to restrict network access to the hostel/index.php Admin Dashboard to trusted IP ranges or a VPN, eliminating the remote (AV:N) attack vector entirely with negligible functional impact for most single-site deployments. Additionally, implementing server-side per-object authorization checks on the ID parameter - verifying that the session's role is permitted to act on the referenced record before processing - directly addresses the CWE-862 root cause and should be the target of any code-level fix. Disabling low-privilege portal accounts from accessing admin-adjacent endpoints is a viable interim control, though it may affect legitimate user workflows. Monitor the VulDB entry at https://vuldb.com/vuln/368263 and the GitHub repository for any upstream patch activity.