Is there a public PoC exploit available for EUVD-2026-31715?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31715. Prioritise patching immediately. EPSS: 0.0%.

Student Grades Management System EUVD-2026-31715

Q: What is the CVSS score of EUVD-2026-31715?

EUVD-2026-31715 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9483 LOW

Improper Authorization (CWE-285)

2026-05-25 VulDB

GHSA-mc5h-x73m-wvcj

PHP Authentication Bypass Student Grades Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:28 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in SourceCodester Student Grades Management System 1.0. Affected is an unknown function of the file grades.php. Performing a manipulation of the argument student_id results in improper authorization. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

Improper authorization in SourceCodester Student Grades Management System 1.0 permits authenticated remote attackers to access or manipulate grade records belonging to other students by tampering with the student_id parameter in grades.php. The flaw (CWE-285) reflects a failure to enforce object-level authorization, allowing a low-privileged user to cross access boundaries to other students' data. A publicly available proof-of-concept exists on GitHub, though EPSS sits at 0.04% (11th percentile) and SSVC classifies exploitation as none, indicating no evidence of active exploitation in the wild despite the POC.

Technical ContextAI

The affected product is a PHP-based academic management application distributed by SourceCodester, primarily used in educational demo or small-deployment contexts. The vulnerable component is grades.php, which accepts a student_id parameter to retrieve or modify grade records. CWE-285 (Improper Authorization) indicates the application fails to verify that the authenticated user is actually authorized to operate on the resource identified by the supplied student_id - a classic Insecure Direct Object Reference (IDOR) pattern. The CPE string cpe:2.3:a:sourcecodester:student_grades_management_system:*:*:*:*:*:*:*:* covers version 1.0 as confirmed by EUVD, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the attack is network-reachable, requires no special conditions beyond having a low-privilege account, and needs no user interaction.

RemediationAI

No vendor-released patch has been identified at time of analysis; the references do not include a patched release version from SourceCodester. As an immediate compensating control, administrators should implement server-side authorization checks in grades.php that validate the authenticated session's user identity against the requested student_id before returning or modifying any record - rejecting requests where the IDs do not match or the user lacks an explicit administrative role. Access to grades.php should be restricted via web server configuration (e.g., IP allowlisting or requiring elevated role authentication) to reduce exposure. Organizations running this application in any production or semi-production capacity should consider migrating to a maintained alternative, given SourceCodester's history of infrequent security updates. The GitHub POC at https://github.com/Jack-MRJ/Student-Grades-Management-System-Vulnerability-Report and VulDB advisory at https://vuldb.com/vuln/365464 provide additional technical detail for developers implementing a fix.