Student Management System CVE-2026-82553

Exploitation requires a valid, authenticated session with at least a student-level account (PR:L per CVSS 4.0 vector). No special server-side configuration is required - the flaw exists in the default code path of student_dashboard.php whenever the application is deployed and student accounts are active. Network access to the web application is required (AV:N). What limits exploitation: the attacker must already hold a legitimate student account, so entirely unauthenticated external parties cannot exploit this directly. Impact is bounded to the data exposed by the student dashboard (low confidentiality, low integrity per VC:L/VI:L); administrative data or system-level access is not implicated by the available description.

The CVSS 4.0 base score of 2.1 accurately reflects the constrained impact: exploitation requires prior authentication (PR:L), and outcome is limited to low confidentiality and integrity exposure (VC:L/VI:L/VA:L) with no scope change to subsequent systems. The E:P modifier (exploit publicly available) lowers the bar for abuse but does not raise the base score. No CISA KEV listing exists, and EPSS data is not provided, so exploitation probability cannot be quantified from the available data. Real-world risk is further bounded by the product's rare deployment footprint - a single-developer open-source PHP project with no enterprise presence. The primary concern is the indefinite unpatched state: the project has not responded to disclosure, and its rolling-release model means no fix version will be announced. For the narrow population of deployments, any enrolled student account is a sufficient foothold to access the records of every other student.

An enrolled student logs into the Student Management System using their own credentials. After obtaining their own roll_no from the dashboard URL, they iterate over adjacent numeric values (e.g., incrementing or decrementing the parameter) in direct requests to student_dashboard.php. Because no server-side ownership check exists, the application returns records for other students - names, grades, personal details - for each valid roll_no value. A public proof-of-concept demonstrating this parameter manipulation is available on GitHub.