Student Management System EUVD-2026-33450

No special conditions are required - the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms remote, unauthenticated exploitation against the login page of any network-accessible deployment of Student Management System 1.0. The only prerequisite is that the application's login page be reachable over a network. Exploitation is limited by: network exposure (instances not exposed to the internet or restricted by firewall rules are not directly reachable remotely), and the inherently low-privilege nature of a student management web application which may not hold highly sensitive data in all deployments. No authentication, specific OS platform, non-default configuration, or user interaction is required.

The CVSS 4.0 score of 5.5 (Medium) is grounded in a fully network-accessible, zero-prerequisite attack (AV:N/AC:L/AT:N/PR:N/UI:N/E:P), meaning the vulnerability is trivially reachable and a proof-of-concept exists, which elevates real-world exploitation likelihood beyond what the medium score implies. The impact metrics are rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) on the vulnerable system with no scope change to secondary systems, which suppresses the score despite the ease of exploitation. No EPSS score was provided in the intelligence data. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been reported. However, the combination of unauthenticated network access, publicly disclosed POC, and vendor non-response creates a meaningful window of risk for any internet-exposed deployment. This is not a theoretical risk - it is a low-complexity, publicly exploitable issue with no available patch.

An unauthenticated remote attacker navigates to the publicly accessible login page of a deployed Student Management System 1.0 instance and submits a crafted SQL injection payload in the email field (e.g., a tautology such as ' OR '1'='1'--) to bypass authentication or enumerate database contents. A public proof-of-concept exploit has been published via GitHub issue #2 (https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/2), meaning the exact exploit technique is openly documented and requires minimal attacker skill to replicate.