Student Grades Management System CVE-2026-9484

Exploitation requires the attacker to hold a valid authenticated session in the Student Grades Management System (CVSS PR:L - low privileges), meaning a registered user account is a hard prerequisite. The target endpoint is classroom.php, which must be accessible over the network (AV:N). No user interaction by a victim is required (UI:N), and no additional technology or complex preconditions are specified (AC:L, AT:N). What limits exploitation: the attacker must already have a legitimate account on the specific instance, ruling out unauthenticated mass exploitation. The impact is bounded to classroom enrollment data only (VC:L/VI:L) with no lateral scope change to other system components. Deployments that do not expose classroom.php to untrusted authenticated users (e.g., read-only student portals) reduce practical risk further.

The CVSS 4.0 base score of 2.1 (LOW) is consistent with the limited scope: AV:N confirms network accessibility, AC:L indicates no special conditions, PR:L confirms a valid (low-privileged) account is required, and VC:L/VI:L/VA:L indicate only limited confidentiality, integrity, and availability impact with no scope change (SC:N/SI:N/SA:N). The E:P modifier in the CVSS 4.0 vector confirms the publicly available POC, slightly elevating practical risk over the theoretical base. EPSS at 0.04% (13th percentile) strongly suggests this vulnerability is not being actively leveraged in broad exploitation campaigns. The absence of a CISA KEV listing corroborates low observed exploitation. Real-world risk is further constrained by the niche deployment base - this is a small, community-developed PHP application primarily used in academic settings, not enterprise infrastructure. Overall, this is a low-priority, low-urgency finding for most organizations, though institutions running this specific application should treat it as an authorization design flaw requiring remediation.

An authenticated student or low-privileged user logs into the Student Grades Management System and sends a crafted HTTP request to classroom.php, substituting arbitrary classroom_id values to invoke getClassroomStudents and enumerate the student roster of classrooms they are not enrolled in, or calls removeStudentFromClassroom to illicitly remove students from those classrooms. A publicly available exploit repository at https://github.com/Jack-MRJ/Student-Grades-Management-System-Vulnerability-Report demonstrates the exact request format, lowering the barrier for exploitation by unsophisticated attackers with valid credentials.