Is there a public PoC exploit available for CVE-2026-11335?

Yes, a public proof-of-concept exploit is available for CVE-2026-11335. Prioritise patching immediately. EPSS: 0.0%.

CollegeManagementSystem CVE-2026-11335

Q: What is the CVSS score of CVE-2026-11335?

CVE-2026-11335 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34842 LOW

Session Fixation (CWE-384)

2026-06-05 VulDB

GHSA-qvf5-p4rv-885c

PHP Information Disclosure Session Fixation

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 05, 2026 - 15:22 NVD

MEDIUM LOW

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 05, 2026 - 15:04 vuln.today

DescriptionCVE.org

A flaw has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This impacts the function session_start of the file /login-form.php. Executing a manipulation of the argument UserAuthData can lead to session fixiation. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Session fixation in tittuvarghese CollegeManagementSystem enables remote attackers to hijack authenticated user sessions by pre-setting a session identifier via the UserAuthData argument passed to session_start() in /login-form.php. Successful exploitation requires a victim to complete login through an attacker-crafted URL, granting the attacker access to the victim's authenticated session with partial confidentiality, integrity, and availability impact (C:L/I:L/A:L). A publicly available exploit exists via a published GitHub issue, but no patch has been released and the maintainer has not responded to responsible disclosure.

Technical ContextAI

The vulnerability is rooted in CWE-384 (Session Fixation), a class of flaws where a web application fails to regenerate a new session identifier upon successful authentication. In PHP applications, session_start() can accept externally influenced session IDs if input sanitization and session ID regeneration are absent. Here, the UserAuthData argument in /login-form.php is manipulable by an attacker prior to the victim authenticating, meaning the session token established before login persists afterward. This allows an attacker who knows the pre-authentication session ID to laterally access the now-authenticated session. The CPE string cpe:2.3:a:tittuvarghese:collegemanagementsystem:*:*:*:*:*:* confirms all versions of this PHP-based college management application are affected, consistent with the project's explicit lack of versioning.

RemediationAI

No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the disclosure. The primary remediation is a code-level fix: PHP developers should call session_regenerate_id(true) immediately after successful credential validation in /login-form.php, which destroys the pre-authentication session and issues a new, unpredictable session ID - this directly eliminates the fixation vector. As a compensating control, deployments should ensure the session.use_strict_mode PHP INI directive is enabled (set session.use_strict_mode = 1 in php.ini), which causes PHP to reject externally provided unrecognized session IDs; note this may not fully remediate if UserAuthData is being explicitly passed into session functions rather than via standard cookie mechanisms. Additionally, restricting access to the login endpoint at the network perimeter (e.g., via IP allowlisting if the application serves a closed campus population) limits exposure to external attackers. The trade-off of network restriction is accessibility loss for remote users. The GitHub issue documenting the exploit is at https://github.com/tittuvarghese/CollegeManagementSystem/issues/4.