CET Grading System CVE-2026-14608

Q: What is the CVSS score of CVE-2026-14608?

CVE-2026-14608 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41565 LOW

Improper Authorization (CWE-285)

2026-07-03 cna@vuldb.com

GHSA-5q58-24gf-29rm

PHP Authentication Bypass

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable IDOR with auth required (PR:L); only student record confidentiality affected (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 20:30 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=view_student of the component POST Handler. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

AnalysisAI

Authorization bypass in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows authenticated remote attackers to view student records they are not authorized to access. By manipulating the ID parameter in POST requests to /index.php?action=view_student, a low-privileged user can enumerate or access other students' data. A public proof-of-concept exploit exists per the CVSS 4.0 E:P supplemental metric; no active exploitation confirmed in CISA KEV.

Technical ContextAI

The affected application is a PHP-based academic grading system distributed by SourceCodester, targeting educational institutions. CWE-285 (Improper Authorization) describes the root cause: the POST handler at /index.php?action=view_student does not enforce ownership or role-based checks on the supplied ID parameter, allowing any authenticated session to substitute arbitrary student IDs and retrieve records outside their permitted scope. This is a classic Insecure Direct Object Reference (IDOR) pattern nested within broken function-level authorization. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L confirms network exploitability with low attack complexity and no special attack requirements beyond a valid low-privilege session.

RemediationAI

No vendor-released patch has been identified at the time of analysis; the referenced sources at vuldb.com and sourcecodester.com do not document a fixed version. As a compensating control, restrict access to the /index.php?action=view_student endpoint to only the roles that legitimately require it via application-level middleware or web server access rules, noting this may affect legitimate multi-role workflows. Implement server-side ownership validation so that the queried student ID is cross-referenced against the authenticated session's associated records before returning data. Additionally, limit exposure of the application to trusted internal networks rather than public internet, reducing the attacker pool. Monitor VulDB advisory at https://vuldb.com/vuln/376116 for patch availability updates.