CET Grading System CVE-2026-12529

Q: What is the CVSS score of CVE-2026-12529?

CVE-2026-12529 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

Improper Access Control (CWE-284)

2026-06-17 VulDB

Authentication Bypass PHP Cet Automated Grading System With Ai Predictive Analytics

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable self-registration endpoint requires no privileges or interaction; limited but tripartite low impact consistent with access control bypass on a single system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 20:00 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The manipulation leads to improper access controls. Remote exploitation of the attack is possible.

AnalysisAI

Improper access control in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 exposes the Student Self-Registration Endpoint (/index.php) to unauthenticated remote exploitation. The CWE-284 root cause, combined with the 'Authentication Bypass' tag, indicates that the self-registration flow fails to enforce intended access boundaries, potentially allowing unauthenticated users to access, manipulate, or enumerate data beyond their authorized scope. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

The affected application is a PHP-based academic tool distributed by SourceCodester (sourcecodester.com), targeting educational institutions. The vulnerable component is the Student Self-Registration Endpoint handled by /index.php. CWE-284 (Improper Access Control) indicates the application fails to correctly validate or enforce who is permitted to perform certain actions or access certain resources - in this context, the self-registration flow likely allows manipulation of parameters or invocation of privileged actions without enforcing role or session checks. The CPE string (cpe:2.3:a:sourcecodester:cet_automated_grading_system_with_ai_predictive_analytics:*:*:*:*:*:*:*:*) covers all versions, as no fixed release is identified. The 'Authentication Bypass' tag further suggests the flaw may allow skipping authentication gates entirely, not merely escalating within an authenticated session.

RemediationAI

No vendor-released patch has been identified at time of analysis. The VulDB submission at https://vuldb.com/submit/837783 indicates this was a community-reported finding; no corresponding SourceCodester patch or advisory exists in the referenced sources. As a compensating control, administrators should immediately restrict public network access to the /index.php self-registration endpoint using web server access controls (e.g., Apache .htaccess IP allowlisting or nginx location-block restrictions) - note this may break legitimate self-registration workflows if remote access by students is intended. If self-registration is not actively required, disable the feature entirely by removing or blocking access to the endpoint. Additionally, enforce server-side session and role validation on all registration-adjacent actions as a code-level fix. Deploy a web application firewall rule to detect and block abnormal parameter manipulation on the registration endpoint. Monitor access logs for unexpected registration activity from unknown source IPs.