Which versions of PHP are affected by CVE-2026-5642?

CVE-2026-5642 affects Cyber-III Student-Management-System and allows unauthenticated attackers to bypass authentication and modify student records through crafted HTTP requests, with publicly…

Is there a public PoC exploit available for CVE-2026-5642?

Yes, a public proof-of-concept exploit is available for CVE-2026-5642. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5642?

24 hours: Immediately identify all systems running Cyber-III Student-Management-System and isolate internet-facing instances or restrict access to /viva/update.php via network controls (firewall rules, WAF rules blocking POST to that endpoint). 7 days: Contact the project maintainer directly and evaluate alternative student management solutions; implement web application firewall rules to detect and block suspicious POST parameters to /viva/update.php. 30 days: Migrate to a patched or alternative vendor solution; conduct audit of student records for unauthorized modifications dating back to deployment date.

PHP CVE-2026-5642

Q: What is the CVSS score of CVE-2026-5642?

CVE-2026-5642 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19213 MEDIUM

Improper Authorization (CWE-285)

2026-04-06 VulDB

GHSA-v373-4mh7-8fh7

PHP Authentication Bypass Student Management System Cyber Iii

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 10:00 euvd

EUVD-2026-19213

Analysis Generated

Apr 06, 2026 - 10:00 vuln.today

CVE Published

Apr 06, 2026 - 09:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the file /viva/update.php of the component HTTP POST Request Handler. This manipulation of the argument Name causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in Cyber-III Student-Management-System allows unauthenticated remote attackers to bypass authentication controls via crafted HTTP POST requests to /viva/update.php. The vulnerability (CWE-285) enables unauthorized modification of student records by manipulating the 'Name' parameter. Publicly available exploit code exists (GitHub issue #236), and the project maintainer has not responded to responsible disclosure attempts. EPSS data not provided, but CVSS 7.3 with PR:N indicates significant risk for internet-facing deployments.

Technical ContextAI

This vulnerability stems from improper authorization (CWE-285) in a PHP-based student management system. The /viva/update.php endpoint processes HTTP POST requests without properly validating user permissions before performing update operations. The flaw allows manipulation of the 'Name' parameter to execute unauthorized database modifications. CWE-285 represents a failure to restrict operations to authenticated and authorized users, distinct from authentication bypass (which prevents identity verification) - this is an authorization flaw where access controls exist but are improperly enforced. The application uses a rolling release model with continuous delivery, making version tracking challenging. The affected codebase at commit 1a938fa61e9f735078e9b291d2e6215b4942af3f demonstrates the vulnerability in the HTTP POST request handler for student record updates.

RemediationAI

No vendor-released patch identified at time of analysis - the project maintainer has not responded to the vulnerability disclosure submitted via GitHub issue #236 (https://github.com/Cyber-III/Student-Management-System/issues/236). Organizations currently running this system should implement immediate compensating controls: restrict network access to /viva/update.php through web application firewall rules or authentication gateway, implement server-level authentication requirements for the entire /viva/ directory, or consider migration to alternative student management systems with active maintenance. If continued use is necessary, conduct manual code review of /viva/update.php to add proper authorization checks verifying user permissions before processing Name parameter updates. Monitor access logs for suspicious POST requests to this endpoint. Given the vendor's non-responsiveness and rolling release model without version tracking, long-term remediation may require forking the codebase for internal security hardening or replacing the application entirely. Reference VulDB entry 355430 (https://vuldb.com/vuln/355430) for ongoing intelligence updates.