Soarkey StudentManagement CVE-2026-111993

Exploitation requires local access to the system running Soarkey StudentManagement plus low-level privileges (PR:L) - i.e., an existing authenticated or local user account - because the weakness is that the application stores sensitive credential data in cleartext (CWE-312) rather than exposing it over the network. Limiting factors: the attack vector is local only (AV:L, no remote exploitation), it requires at least low privileges to reach the stored data, and the product is an unmaintained open-source student project with negligible production deployment, which sharply narrows realistic exposure.

Real-world risk is very low despite public exploit availability. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) scores just 1.9, reflecting local-only access, required low privileges, and only limited confidentiality impact (VC:L) with no integrity or availability impact. Exploitation status is 'publicly available exploit code exists' (POC via the GitHub issue report), but this is NOT active exploitation - the CVE is not in CISA KEV and no EPSS score was provided. The flaw (CWE-312, cleartext storage of sensitive information in UserDao.login) is a code-quality/hardening weakness rather than a remotely weaponizable vulnerability. Signals are consistent rather than conflicting: low CVSS, local vector, and a POC that is merely an unanswered GitHub issue all point to a low-priority, academic finding. This is a classic high-noise/low-real-risk issue: a VulDB-sourced report against an unmaintained student/hobby project, not a production-prioritizable threat.

An attacker or malicious insider with local, low-privileged access to the host running StudentManagement reads stored credentials that the application persists in cleartext via the login flow, recovering passwords without needing to crack any hash. A proof-of-concept exists in the form of a public GitHub issue, but exploitation requires being already present on the system (AV:L), limiting it to local actors.