Is there a public PoC exploit available for CVE-2026-9517?

Yes, a public proof-of-concept exploit is available for CVE-2026-9517. Prioritise patching immediately. EPSS: 0.0%.

CodeIgniter-StudentManagementSystem CVE-2026-9517

Q: What is the CVSS score of CVE-2026-9517?

CVE-2026-9517 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31773 MEDIUM

Improper Access Control (CWE-284)

2026-05-26 VulDB

GHSA-v3mc-64fg-f7r7

PHP Authentication Bypass Codeigniter Studentmanagementsystem

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:09 vuln.today

Severity Changed

May 26, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:52 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in hemant6488 CodeIgniter-StudentManagementSystem. The affected element is an unknown function of the file /index.php/students/addStudentView of the component Student Management Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper access control in hemant6488's CodeIgniter-StudentManagementSystem exposes the student addition endpoint at /index.php/students/addStudentView to unauthenticated remote manipulation, enabling read, write, and partial availability impact on student data without credentials. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication is required from any network, and a publicly available exploit (GitHub issue #5) has been documented. No vendor patch exists and the maintainer has not responded to the coordinated disclosure, leaving all deployed instances unmitigated.

Technical ContextAI

The affected product is a PHP student management application built on the CodeIgniter framework, identified by CPE cpe:2.3:a:hemant6488:codeigniter-studentmanagementsystem:*:*:*:*:*:*:*:*. CWE-284 (Improper Access Control) is the root cause class, indicating the application's Student Management Handler fails to enforce authorization checks before processing requests to the addStudentView function. The 'Authentication Bypass' tag corroborates that the route does not validate session state or user privileges prior to executing privileged operations, a common failure mode in CodeIgniter applications that rely on controller-level access checks without a centralized authentication filter applied to sensitive routes.

RemediationAI

No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the disclosure reported via GitHub issue #5 (https://github.com/hemant6488/CodeIgniter-StudentManagementSystem/issues/5). As an immediate compensating control, restrict access to /index.php/students/addStudentView at the web server or reverse proxy layer using IP allowlists limited to known administrative networks - this blocks unauthenticated external access without modifying application code, though it requires network segmentation to be effective. A secondary control is to impose HTTP Basic Authentication at the server level (nginx auth_basic or Apache mod_auth) as a stopgap in front of the endpoint, accepting the trade-off that this adds a credential layer outside the application's own session management. If student addition functionality is non-critical to operations, disabling or removing the route entirely is the lowest-risk option until the upstream project issues a fix. Monitor https://vuldb.com/vuln/365537 for patch availability.