Is there a public PoC exploit available for EUVD-2026-31726?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31726. Prioritise patching immediately. EPSS: 0.0%.

Student Grades Management System EUVD-2026-31726

Q: What is the CVSS score of EUVD-2026-31726?

EUVD-2026-31726 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9486 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-25 VulDB

GHSA-6r8r-5rq8-v6fv

CSRF Student Grades Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:29 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Student Grades Management System 1.0. This affects an unknown part. The manipulation results in cross-site request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Cross-site request forgery in SourceCodester Student Grades Management System 1.0 enables remote attackers to perform unauthorized state-changing actions - such as modifying student grade records - by tricking authenticated users into visiting a malicious page. The CVSS 4.0 score of 2.1 reflects constrained impact: integrity loss is low (VI:L), and there is no confidentiality or availability consequence. A publicly available proof-of-concept exploit exists on GitHub (corroborated by E:P in the CVSS vector), though EPSS at 0.02% (4th percentile) signals negligible observed exploitation activity and no public exploit identified at time of analysis has matured into confirmed active exploitation.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) arises when a web application processes state-changing requests without verifying they originate from the legitimate authenticated session rather than a third-party origin. The affected product - CPE cpe:2.3:a:sourcecodester:student_grades_management_system:*:*:*:*:*:*:*:* - is a PHP-based academic grade management application distributed by SourceCodester, primarily used as an educational or demo project. The root cause is the structural absence of anti-CSRF tokens on state-changing form endpoints and/or missing SameSite cookie protections, allowing an attacker-controlled page to forge authenticated requests on behalf of any logged-in user. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms network reachability with low complexity, no attack requirements, and no privilege escalation needed on the attacker side.

RemediationAI

No vendor-released patch has been identified at time of analysis. Since SourceCodester applications are open-source educational projects without a formal patching pipeline, administrators must implement CSRF mitigations directly in the application code. The primary fix is to add synchronizer (anti-CSRF) tokens to all state-changing forms and validate them server-side on every submission - this is the industry-standard defense for CWE-352. Secondary controls include setting the SameSite=Strict or SameSite=Lax attribute on session cookies, which prevents cross-origin request forgery in modern browsers but may break legitimate cross-site integrations if present. Verifying the HTTP Origin or Referer header server-side provides an additional layer but can be spoofed in some configurations and may cause false positives. If immediate code changes are not feasible, restricting access to the application to internal networks or authenticated VPN users limits the attacker's ability to socially engineer victims. The public POC is documented at https://github.com/Jack-MRJ/Student-Grades-Management-System-Vulnerability-Report and the VulDB advisory is at https://vuldb.com/vuln/365467.