Student Management System CVE-2026-9562

The CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L/AT:N) confirms no authentication, no user interaction, and no special configuration is required - remote unauthenticated exploitation is possible against default deployments of STUDENT-MANAGEMENT-SYSTEM where the Dashboard is network-accessible. The specific limiting factor is deployment scope: the application must be reachable over the network (internet or intranet); instances restricted to localhost or protected by network-layer access controls are not directly exploitable. The vulnerability targets the Dashboard component specifically and affects multiple endpoints within it, so any deployment where the Dashboard is exposed without prior authentication enforcement is in scope. No special configuration is required to be vulnerable - the flaw is in the application's default access control logic. The exploit does not require a specific operating system, database engine, or server platform beyond a functioning web server running this PHP application.

The CVSS 4.0 base score of 5.5 (Medium) reflects constrained impact - confidentiality, integrity, and availability impacts are all rated Low on the vulnerable component, with no downstream system impact (SC:N/SI:N/SA:N). The attack profile is highly permissive: network-accessible, low complexity, no privileges, no user interaction, which would typically signal elevated real-world risk. However, the EPSS score of 0.04% at the 14th percentile strongly suggests this vulnerability has not attracted broad automated exploitation or mass scanning activity. The product is not listed in the CISA KEV catalog. The exploit modifier E:P in the CVSS 4.0 vector confirms publicly available proof-of-concept code, which marginally elevates the real-world risk above theoretical. The maintainer has not responded to the disclosure and no patch has been released. The primary risk is concentrated in organizations that have deployed this specific open-source student management application in an internet-accessible configuration. The combination of an unpatched codebase, a public exploit, unauthenticated network access, and no vendor response represents a meaningful but likely niche threat given the low EPSS percentile.

An unauthenticated attacker who identifies an internet-exposed instance of the STUDENT-MANAGEMENT-SYSTEM can send crafted HTTP requests directly to one or more Dashboard endpoints, bypassing the expected authentication checks. Using the publicly disclosed proof-of-concept available at https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/1#issue-434890558, the attacker accesses or modifies student records - including potentially sensitive personal data - without ever presenting valid credentials. Because multiple endpoints are affected, the attacker can enumerate exposed routes to maximize data exposure or make unauthorized data modifications.