Student Grades Management System EUVD-2026-31715

Exploitation requires a valid low-privilege authenticated session in the application (CVSS PR:L), meaning the attacker must possess at minimum a student-level account. The vulnerable endpoint is grades.php, and exploitation is triggered by supplying an arbitrary student_id value belonging to a different user. No additional non-default configuration is required - any deployment of version 1.0 with standard multi-user student accounts is susceptible. Limiting factors include: the requirement for a pre-existing authenticated account (unauthenticated access is not possible per PR:L), SSVC's non-automatable classification (bulk exploitation of many records is not straightforwardly automated), and the application's typical small-scale educational deployment context that reduces the breadth of potential targets.

The CVSS 4.0 base score of 2.1 (LOW) accurately reflects the bounded impact: all three impact dimensions (VC:L/VI:L/VA:L) are low and limited to the vulnerable component with no scope change. EPSS at 0.04% (11th percentile) is consistent with this being a niche educational application unlikely to be targeted broadly. SSVC classifies exploitation as none, the attack as non-automatable, and technical impact as partial - all pointing to a low operational priority. The E:P modifier (proof of concept exists) in the CVSS vector slightly elevates the score but does not change the overall LOW tier. The vulnerability is not listed in CISA KEV, confirming no confirmed active exploitation at time of analysis. The primary risk is intra-application horizontal privilege escalation for users who already have valid credentials - not a remote unauthenticated takeover. Defenders should note that SourceCodester applications are widely deployed as educational demos and may not receive timely vendor patching, which somewhat elevates residual risk for any production deployments.

An attacker with a valid low-privilege student account authenticates to the application and sends a crafted HTTP request to grades.php, substituting their own student_id with that of another student. Because the server performs no ownership check, the response returns or modifies the target student's grade records. A public proof-of-concept demonstrating this technique is available on GitHub, lowering the skill barrier for exploitation.