Is there a public PoC exploit available for CVE-2026-9438?

Yes, a public proof-of-concept exploit is available for CVE-2026-9438. Prioritise patching immediately. EPSS: 0.0%.

StudentManagementSystem CVE-2026-9438

Q: What is the CVSS score of CVE-2026-9438?

CVE-2026-9438 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31647 LOW

Improper Control of Resource Identifiers ('Resource Injection') (CWE-99)

2026-05-25 VulDB

GHSA-rc68-w6qc-cfhf

PHP Information Disclosure Studentmanagementsystem

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:13 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

5.4 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file courseDel.php. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Resource injection in yashpokharna2555's StudentManagementSystem allows low-privileged remote attackers to manipulate the ID parameter in courseDel.php to control which course records are deleted or affected, resulting in unauthorized data integrity and availability impact. The flaw affects the specific git commit cb2f558ddf8d19396de0f92abf2d224d46a0a203 and exploit code is publicly available via a GitHub issue. No patch has been released, and the project maintainer has not responded to the disclosure.

Technical ContextAI

The vulnerability resides in courseDel.php, a PHP script responsible for course deletion within this student management web application (CPE: cpe:2.3:a:yashpokharna2555:studentmanagementsystem:*:*:*:*:*:*:*:*). CWE-99, Improper Control of Resource Identifiers, describes the root cause: user-supplied input - specifically the ID query parameter - is used to construct or resolve a resource identifier (likely a database record key) without adequate validation or authorization checks. This allows the caller to reference resources beyond their intended scope, such as deleting course records belonging to other users or departments. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the attack is network-reachable, requires no interaction, imposes no additional technical complexity, and requires only a low-privilege authenticated session - consistent with a standard logged-in student or instructor account submitting a crafted HTTP request.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the disclosure report submitted via GitHub issue (https://github.com/yashpokharna2555/StudentManagementSystem/issues/1). As a primary compensating control, operators should add server-side authorization checks in courseDel.php to verify that the authenticated user has explicit permission to delete the resource identified by the supplied ID, preventing horizontal privilege escalation. Additionally, input validation should enforce that the ID parameter is a positive integer matching a record owned by or accessible to the requesting user. As a network-level mitigation, restrict access to the application to trusted IP ranges or require VPN access, reducing the exposed attack surface; note this does not fix the underlying flaw but limits the pool of potential attackers to those with network access. Organizations running this application in production should monitor the upstream repository for any patch commits and upgrade immediately upon availability.