Is there a public PoC exploit available for EUVD-2026-33695?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33695. Prioritise patching immediately. EPSS: 0.0%.

Student-Management-System EUVD-2026-33695

Q: What is the CVSS score of EUVD-2026-33695?

EUVD-2026-33695 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10271 LOW

Execution After Redirect (EAR) (CWE-698)

2026-06-01 VulDB

GHSA-5q78-whf2-pmwx

Information Disclosure Student Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 17:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 17:21 vuln.today

DescriptionCVE.org

A flaw has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The affected element is an unknown function of the file admin/ of the component Admin Endpoint. This manipulation of the argument uid causes execution after redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Execution After Redirect (EAR) in a4m4's Student-Management-System exposes admin/ endpoints to unauthorized data access via manipulation of the uid parameter, allowing server-side PHP logic to execute and return sensitive output despite issuing an HTTP redirect response. The CVSS vector (PR:N) confirms no authentication is required, and the exploit has been publicly published via a GitHub issue, making this trivially reproducible. No patch exists and the project maintainer has not responded to disclosure, leaving all deployed instances exposed with no vendor remediation timeline.

Technical ContextAI

CWE-698 (Execution After Redirect, EAR) is a PHP web application anti-pattern where a server issues an HTTP 302 redirect - typically to enforce access control by redirecting unauthenticated users to a login page - but fails to include an exit() or die() call after the header() invocation. The PHP interpreter continues processing the remainder of the script, and the protected output (database records, admin data) is included in the response body even though the HTTP status code signals a redirect. The affected product, identified via CPE cpe:2.3:a:a4m4:student-management-system:*:*:*:*:*:*:*:*, is a PHP-based academic management application. The uid argument manipulation component suggests the admin/ endpoint accepts a user identifier parameter that influences which records are queried and returned, compounding the EAR flaw with a potential insecure direct object reference (IDOR) pattern. Multiple admin/ endpoints are confirmed affected.

RemediationAI

No vendor-released patch identified at time of analysis - the project maintainer has not responded to the responsible disclosure. The correct code-level fix is to add exit; or die; immediately after every header('Location: ...') redirect call in all admin/ PHP scripts, preventing continued script execution after the redirect response is issued. As an immediate compensating control, restrict access to the admin/ directory to trusted administrator IP addresses only, using an .htaccess Deny/Allow directive or an equivalent web server (Apache/nginx) access control rule - this eliminates remote unauthenticated access entirely but requires static IP management and breaks legitimate remote admin access. A Web Application Firewall (WAF) rule blocking or alerting on direct requests to admin/ endpoints from non-admin source IPs provides detection coverage. Administrators should audit HTTP access logs for requests to admin/ paths that return 302 status codes paired with non-empty response bodies, which is the signature of EAR exploitation. The VulDB advisory is available at https://vuldb.com/vuln/367550.