College Management System CVE-2026-95828

Exploitation requires the victim to authenticate to the College-Management-System while using a session identifier the attacker controls or can predict, because server.php's session_start does not regenerate the session ID at login (CWE-384). The key limiting factor is required user interaction (UI:P/UI:R): the attacker cannot act alone and must trick a victim into logging in under the fixed session. No attacker authentication is needed (PR:N), and the attack is remote over the network, but success is contingent on the victim completing an authenticated login through the attacker-influenced session.

This is a low-priority, high-noise finding. The vendor CVSS 4.0 base score is 2.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N), reflecting a network-reachable but user-interaction-gated session fixation flaw with only limited confidentiality impact and no integrity/availability impact. The E:P (Proof-of-Concept) exploit maturity is consistent with the input signal that POC/exploit code is publicly available - here that 'exploit' is simply the GitHub issue report (#8) describing the flaw, not a weaponized tool. There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. Exploitation status: publicly available exploit code exists (a public issue write-up), but this must NOT be conflated with active exploitation. The affected software (Mstfakts College-Management-System) is an obscure single-author GitHub project with no meaningful enterprise footprint, further reducing real-world risk. Note a data caveat: the project uses rolling releases, so no affected/fixed version boundaries exist, and the maintainer has not responded to the report - meaning no patch is confirmed available.

An attacker crafts a link to the application containing a session identifier they already know (or induces the app to accept a fixed session ID before login), then lures a victim to authenticate through that link. Because server.php's session_start does not regenerate the session ID upon authentication, the victim's now-authenticated session is bound to the attacker-known ID, allowing the attacker to reuse it and impersonate the victim. A public write-up of the issue exists (GitHub issue #8), but no automated weaponized exploit is indicated.