Student Grades Management System EUVD-2026-31721

Exploitation requires the attacker to hold a valid, low-privilege authenticated account within the Student Grades Management System (PR:L per CVSS 4.0 vector) with write access to the Remarks field in students.php. Additionally, a second authenticated user must passively view the page containing the injected Remarks content (UI:P per CVSS 4.0 vector) - meaning the attacker must pre-stage the payload and wait for a privileged user to browse to the affected record. This two-actor dependency is the primary limiting factor for exploitation. The vulnerability is scoped to SourceCodester Student Grades Management System 1.0 only, with impact limited to low integrity effects on the vulnerable system and no confidentiality, availability, or cross-system impact confirmed. No network-layer privilege escalation path exists based on available data.

Multiple signals converge on low real-world risk despite the existence of a public proof-of-concept. The CVSS 4.0 score of 2.0 reflects substantive constraints: the attacker must hold a valid low-privilege account (PR:L) and exploitation depends on a second victim passively viewing the injected content (UI:P), both of which prevent automated mass exploitation. SSVC explicitly confirms 'Automatable: no,' consistent with the UI:P constraint, and rates technical impact as 'partial' - matching the CVSS finding of only low integrity impact (VI:L) with no confidentiality, availability, or cross-system effects. EPSS at 0.03% (9th percentile) places this well below typical triage thresholds. There is no CVSS vector conflict to flag. The primary risk is internal: a malicious low-privilege user targeting a higher-privileged administrator or teacher within the same application. The product's academic/educational deployment context further narrows the real-world attack surface. No vendor-released patch has been identified, but the combination of low CVSS, absent KEV listing, and SSVC 'none' exploitation status makes this a low-priority remediation item for most organizations.

An authenticated low-privilege user - such as a student or data-entry clerk with write access to the Remarks field - injects a JavaScript payload (e.g., a cookie-stealing script) into the Remarks parameter via students.php. When a higher-privileged user such as a teacher or administrator subsequently views the student record containing the injected content, the script executes in their browser session, potentially enabling session token theft or unauthorized UI manipulation. A public proof-of-concept is available on GitHub at https://github.com/Jack-MRJ/Student-Grades-Management-System-Vulnerability-Report, significantly lowering the technical barrier for exploitation by low-skill attackers.