Is there a public PoC exploit available for EUVD-2026-31901?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31901. Prioritise patching immediately. EPSS: 0.0%.

Student Management System EUVD-2026-31901

Q: What is the CVSS score of EUVD-2026-31901?

EUVD-2026-31901 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9562 MEDIUM

Improper Access Control (CWE-284)

2026-05-26 VulDB

GHSA-p73g-287j-9jq7

Authentication Bypass Student Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:30 vuln.today

Severity Changed

May 26, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 17:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The affected element is an unknown function of the component Dashboard. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper access control in sambitraj's STUDENT-MANAGEMENT-SYSTEM exposes multiple Dashboard endpoints to unauthenticated remote attackers, enabling unauthorized read and write operations on student data. The vulnerability, tagged as an authentication bypass (CWE-284), affects all code up to and including commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 and is confirmed by a publicly disclosed exploit via GitHub issue. No public exploit identified at time of analysis for active KEV-level exploitation, however publicly available exploit code exists and the maintainer has not responded to responsible disclosure, leaving the codebase unpatched.

Technical ContextAI

The affected product is sambitraj's STUDENT-MANAGEMENT-SYSTEM, a PHP-based web application for managing student records, identified by CPE cpe:2.3:a:sambitraj:student-management-system:*:*:*:*:*:*:*:*. The root cause is CWE-284 (Improper Access Control), which in this context manifests as missing or bypassable authorization checks on Dashboard component endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the vulnerability is remotely exploitable over the network with no authentication, no attack complexity, and no user interaction required. The 'Authentication Bypass' tag indicates that the application fails to enforce session or credential validation on one or more Dashboard routes, allowing direct endpoint access without a valid authenticated session. Multiple endpoints are reported affected, broadening the attack surface beyond a single function.

RemediationAI

No vendor-released patch identified at time of analysis - the maintainer has not responded to the disclosed GitHub issue (https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/1) as of the report date. Organizations running this application should immediately restrict network access to the Dashboard component by placing it behind a web application firewall or requiring VPN access, thereby removing internet-exposed attack surface. Specifically, block unauthenticated access to all Dashboard-related routes at the reverse proxy or firewall layer; this trade-off is that legitimate remote users may lose direct access until proper authentication is enforced. Operators capable of modifying the source code should implement server-side session and role validation on every Dashboard endpoint and submit a pull request to the upstream repository. Monitoring web server access logs for unexpected or unauthorized requests to Dashboard endpoints can provide early detection. As a last resort, taking the application offline or restricting it to localhost-only access eliminates the remote attack vector entirely. Track the upstream repository at https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/ for any future patch commits.