Is there a public PoC exploit available for CVE-2026-11336?

Yes, a public proof-of-concept exploit is available for CVE-2026-11336. Prioritise patching immediately. EPSS: 0.0%.

CollegeManagementSystem CVE-2026-11336

Q: What is the CVSS score of CVE-2026-11336?

CVE-2026-11336 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34848 LOW

Improper Authorization (CWE-285)

2026-06-05 VulDB

GHSA-j824-hj46-xvfv

PHP Authentication Bypass Collegemanagementsystem Tittuvarghese

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 05, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jun 05, 2026 - 16:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 05, 2026 - 16:17 vuln.today

DescriptionCVE.org

A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboard_page/admin_page.php of the component Admin Interface. The manipulation of the argument UserAuthData leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in tittuvarghese CollegeManagementSystem exposes the Admin Interface to privilege escalation by low-privileged authenticated users who can manipulate the UserAuthData parameter in dashboard_page/admin_page.php. A publicly available exploit exists (referenced in GitHub issue #5), raising practical risk above what the mid-range CVSS score of 6.3 alone would suggest. The vendor has not responded to the responsible disclosure, and no patch has been released; all deployed instances across the rolling release track remain exposed.

Technical ContextAI

CollegeManagementSystem is a PHP-based web application for academic institution management, identified by CPE cpe:2.3:a:tittuvarghese:collegemanagementsystem:*:*:*:*:*:*:*:*. The vulnerable component is the Admin Interface, specifically the file dashboard_page/admin_page.php. CWE-285 (Improper Authorization) describes a root cause where the application does not properly verify that an authenticated principal has the required privilege level before permitting a sensitive action - the server-side logic trusts or insufficiently validates the UserAuthData argument supplied in the request, allowing a lower-privileged user to masquerade as or act with the authority of an administrator. The rolling release model means no discrete version number can be pinned; the commits 3e476335cfbfb9a049e09f474c7ec885f69a9df3 and a38852979f7e27ae67b610dce5979500ef8ebe01 are cited as affected reference points.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer was notified via a GitHub issue report but has not responded. As a compensating control, administrators should enforce server-level access restrictions on dashboard_page/admin_page.php, such as IP allowlisting via web server configuration (e.g., Apache .htaccess or nginx location directives) to limit Admin Interface access to known trusted IP ranges; this trades off remote admin convenience for a meaningful reduction in exposure. Deploying a web application firewall rule to detect and block manipulation of the UserAuthData parameter is a second layer of defense, though rule tuning may be required to avoid disrupting legitimate admin sessions. Auditing existing user accounts for unauthorized privilege escalation is advised given the public exploit availability. Monitor the GitHub repository at https://github.com/tittuvarghese/CollegeManagementSystem/ and VulDB at https://vuldb.com/vuln/368874 for any upstream patch or maintainer response.