Is there a public PoC exploit available for CVE-2026-11532?

Yes, a public proof-of-concept exploit is available for CVE-2026-11532. Prioritise patching immediately. EPSS: 0.0%.

Student Management System CVE-2026-11532

Q: What is the CVSS score of CVE-2026-11532?

CVE-2026-11532 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35127 LOW

Improper Access Control (CWE-284)

2026-06-08 VulDB

GHSA-vjm2-83qq-qqmg

PHP Authentication Bypass Student Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:28 vuln.today

Severity Changed

Jun 08, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 17:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected is an unknown function of the file /add.php of the component Student Record Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper access control in imvks786's Student Management System PHP application exposes the /add.php Student Record Handler endpoint to unauthorized manipulation by authenticated remote attackers. The vulnerability, classified under CWE-284, allows a low-privileged user to perform actions beyond their intended authorization scope - consistent with the 'Authentication Bypass' tag suggesting role-boundary violations rather than full pre-auth access. Public exploit code exists per the GitHub issue report, though the CVSS 4.0 score of 2.1 reflects limited impact scope (low confidentiality, integrity, and availability impact, no downstream system effect). The vendor has not responded to the coordinated disclosure.

Technical ContextAI

The affected product is a PHP-based student management web application maintained by imvks786, identified in CPE as cpe:2.3:a:imvks786:student_management_system:*:*:*:*:*:*:*:*. The vulnerable component is the Student Record Handler at /add.php. The root cause class is CWE-284 (Improper Access Control), meaning the application fails to adequately enforce authorization boundaries on record-creation or record-modification operations. Tagged 'Authentication Bypass', this implies the access control flaw is not a complete pre-authentication bypass but rather a privilege boundary violation - a lower-privileged role (e.g., student) can invoke add/modify functionality intended only for higher-privileged roles (e.g., administrator). The application follows a rolling release model with no discrete version tagging, making patch tracking difficult. The last known-vulnerable commit is 9599b560ad3c3b83e75d328b76bedcd489ef1f46.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor has not responded to the coordinated disclosure filed via GitHub issue. As a compensating control, administrators should restrict access to /add.php at the web server or application firewall level, limiting it to only the roles (e.g., administrators) that legitimately require record-creation capabilities; this reduces the exploitable attack surface but may interrupt legitimate low-privilege workflows if those are intended. Additionally, implementing server-side session role validation before processing any record mutations in /add.php would mitigate the CWE-284 root cause directly within the application code. Network-level controls (e.g., placing the application behind a VPN or restricting public internet access) would reduce exposure risk given the AV:N attack vector. Monitor the GitHub repository at https://github.com/imvks786/student_management_system/ for any upstream commits addressing the issue, as the rolling release model means fixes will appear as commits rather than tagged releases.