CET Grading System CVE-2026-14609

Q: What is the CVSS score of CVE-2026-14609?

CVE-2026-14609 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41611 LOW

Session Fixation (CWE-384)

2026-07-03 VulDB

GHSA-c85v-jr5v-hgfw

Session Fixation Information Disclosure Cet Automated Grading System With Ai Predictive Analytics

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

Network vector with high complexity; victim must authenticate with attacker-fixed token (UI:R); no availability impact and no scope change.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:12 vuln.today

Severity Changed

Jul 03, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jul 03, 2026 - 21:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

Severity Changed

Jul 03, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jul 03, 2026 - 21:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

DescriptionCVE.org

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The manipulation results in session fixiation. The attack can be executed remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.

AnalysisAI

Session fixation in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 enables remote attackers to pre-set a known session identifier in a victim's browser, then hijack the authenticated session after the victim logs in. The CVSS 4.0 score of 2.9 reflects limited impact scope (low confidentiality, integrity, and availability) combined with high attack complexity, though a public exploit has been released (E:P). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Deliver crafted URL with fixed session token to victim

Delivery

Victim authenticates to CET Grading System using attacker-set session ID

Exploit

Server fails to regenerate session token on login

Execution

Attacker submits requests with known session token

Impact

Access victim's authenticated session and grade data

Access

Deliver crafted URL with fixed session token to victim

Delivery

Victim authenticates to CET Grading System using attacker-set session ID

Exploit

Server fails to regenerate session token on login

Execution

Attacker submits requests with known session token

Impact

Access victim's authenticated session and grade data

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the CET Automated Grading System accept and persist an attacker-supplied session identifier across the authentication boundary without server-side token regeneration - the defining condition of CWE-384. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 2.9 (AV:N/AC:H/AT:N/PR:N/UI:N) reflects network reachability but constrained practical exploitability due to high attack complexity (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a URL embedding a known session token value and delivers it to a target user via phishing or a secondary injection point. When the victim clicks the link and authenticates to the CET Grading System, the server assigns the attacker's pre-set session ID to the now-authenticated session without regenerating it. …
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.