CET Grading System CVE-2026-14609

Q: What is the CVSS score of CVE-2026-14609?

CVE-2026-14609 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41611 LOW

Session Fixation (CWE-384)

2026-07-03 VulDB

GHSA-c85v-jr5v-hgfw

Session Fixation Information Disclosure Cet Automated Grading System With Ai Predictive Analytics

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

Network vector with high complexity; victim must authenticate with attacker-fixed token (UI:R); no availability impact and no scope change.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:12 vuln.today

Severity Changed

Jul 03, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jul 03, 2026 - 21:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

Severity Changed

Jul 03, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jul 03, 2026 - 21:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

DescriptionCVE.org

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The manipulation results in session fixiation. The attack can be executed remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.

AnalysisAI

Session fixation in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 enables remote attackers to pre-set a known session identifier in a victim's browser, then hijack the authenticated session after the victim logs in. The CVSS 4.0 score of 2.9 reflects limited impact scope (low confidentiality, integrity, and availability) combined with high attack complexity, though a public exploit has been released (E:P). No CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.

Technical ContextAI

CWE-384 (Session Fixation) arises when a web application fails to regenerate the session identifier upon successful authentication, allowing an attacker who already knows the session token to inherit the authenticated context. The affected product is SourceCodester's PHP-based educational web application (CPE: cpe:2.3:a:sourcecodester:cet_automated_grading_system_with_ai_predictive_analytics:*:*:*:*:*:*:*:*), which implements an AI-assisted grading workflow. The flaw resides in session lifecycle management - specifically the absence of server-side session token rotation at login. Tags from VulDB also flag this as an Information Disclosure vector, consistent with session hijacking granting access to grade data and user records.

RemediationAI

No vendor-released patch has been identified at time of analysis. Operators should apply the following compensating controls: (1) Regenerate the session identifier server-side immediately upon successful authentication - this is the definitive fix for CWE-384 and can be implemented without a vendor patch by modifying session handling code; trade-off is minor development effort. (2) Enforce the SameSite=Strict or SameSite=Lax attribute on session cookies to restrict cross-site session delivery vectors used in fixation attacks; trade-off is potential breakage of cross-origin redirect flows. (3) Deploy HTTPS exclusively to prevent session token interception over cleartext channels, reducing the attacker's ability to observe or inject tokens. (4) Implement short session timeouts and absolute expiration to limit the window of opportunity for fixation exploitation. Monitor VulDB entry https://vuldb.com/vuln/376117 and https://www.sourcecodester.com/ for a vendor-released patch.