Student Grades Management System CVE-2026-9486

Exploitation requires that a legitimate authenticated user of the Student Grades Management System - such as a teacher or administrator - holds an active browser session and is simultaneously induced to visit a malicious web page controlled by the attacker (UI:P per CVSS vector). The victim's browser must automatically transmit the valid session cookie with the forged cross-origin request, which occurs by default unless SameSite cookie protections are enforced. No special server-side configuration, elevated privilege, or non-default deployment mode is required on the target side - the vulnerability stems from a structural absence of CSRF validation present in all standard deployments of version 1.0. Exploitation is concretely limited by two factors: the attacker cannot directly trigger the attack without the victim's browser interaction (UI:P), and the maximum damage is low-integrity modification of grade data (VI:L) with no ability to exfiltrate data (VC:N) or disrupt availability (VA:N).

All available signals converge on low real-world risk. The CVSS 4.0 base score of 2.1 is among the lowest possible, driven by passive user interaction (UI:P) and low integrity impact limited to the vulnerable system (VI:L/VC:N/VA:N/SC:N/SI:N/SA:N). EPSS at 0.02% (4th percentile) confirms this vulnerability has not attracted meaningful exploitation interest. The vulnerability is not listed in the CISA KEV catalog. The existence of a public POC on GitHub is a legitimate concern that marginally elevates urgency, but POC availability alone does not indicate active exploitation. SourceCodester applications are educational/hobbyist codebases unlikely to be deployed at scale in sensitive production environments, which further limits aggregate blast radius. No conflicting signals exist - CVSS vector, EPSS, and KEV status all consistently indicate a low-priority finding warranting remediation but no emergency response.

A publicly available proof-of-concept exploit exists on GitHub. An attacker crafts a malicious web page containing a hidden HTML form or JavaScript that automatically submits a forged POST request to the Student Grades Management System targeting a grade-modification endpoint. If a logged-in teacher or administrator is socially engineered into visiting this page - via phishing email or malicious link - their browser transparently sends the forged request with their valid session cookie attached, resulting in unauthorized modification of student grade records without the victim's knowledge.