CET Grading System CVE-2026-12529

No special conditions are required for network access - the Student Self-Registration Endpoint (/index.php) is a publicly accessible PHP endpoint designed for unauthenticated users to register. Exploitation does not require authentication (PR:N in the CVSS 4.0 vector), no user interaction, and no non-default configuration. The primary limiting factor is that the application must be internet-facing or accessible from the attacker's network segment; internally-only deployed instances reduce but do not eliminate risk from insider threats. The specific parameter or mechanism that triggers the access control bypass is not disclosed in available data - the exact manipulation vector is inferred from CWE-284 and the 'Authentication Bypass' tag, not from a confirmed POC. Impact is bounded to low confidentiality, integrity, and availability effects against the vulnerable system only (SC:N/SI:N/SA:N in CVSS 4.0).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with no special attack requirements - a straightforward attack profile. The score of 6.9 reflects limited but real impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). No EPSS data was provided in the input; without it, exploitation probability cannot be quantified. There is no KEV listing and no known public exploit code, which meaningfully reduces near-term risk. However, SourceCodester applications are widely deployed in academic environments in developing regions and are frequently targeted by low-sophistication attackers due to their open distribution model. The 'Authentication Bypass' tag elevates concern beyond what the raw score implies: even low-impact bypass of authentication gates can be a stepping stone to further access. Risk is real but context-dependent - institutions with internet-facing deployments should treat this as a higher priority than the mid-range score alone suggests.

An unauthenticated remote attacker sends a crafted HTTP request to the publicly accessible /index.php Student Self-Registration Endpoint, manipulating parameters to bypass the application's access control checks. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and absence of authentication requirements (PR:N) mean that manual exploitation requires minimal skill once the specific parameter manipulation is identified. The attacker may be able to register unauthorized accounts, access grade data, or trigger unintended application logic.