EUVD-2026-35130
GHSA-5h9q-gwhq-m4wv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this vulnerability is an unknown functionality of the file /see.php of the component Student Deletion Endpoint. The manipulation of the argument del leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Improper authorization in the imvks786 student_management_system PHP application allows authenticated low-privileged remote attackers to delete student records they are not authorized to remove via manipulation of the del parameter at the /see.php Student Deletion Endpoint. The vulnerability (CWE-285) stems from the application failing to verify that the requesting user holds sufficient privileges to perform the deletion action, effectively enabling horizontal or vertical privilege escalation within the data management scope. No public exploit identified at time of analysis via CISA KEV, though publicly available exploit code exists per the referenced GitHub issue disclosure.
Technical ContextAI
The affected product is a PHP-based student management system (CPE: cpe:2.3:a:imvks786:student_management_system:*:*:*:*:*:*:*:*) hosted on GitHub under a rolling release model with no discrete version tags. The vulnerability resides in /see.php, which handles student record deletion via a del GET or POST parameter. CWE-285 (Improper Authorization) indicates the endpoint lacks a server-side authorization check to confirm that the authenticated session user has the appropriate role or ownership to delete the targeted student record. This is a classic insecure direct object reference (IDOR) pattern or missing function-level access control, where the application trusts user-supplied input (the del parameter value) without validating the caller's entitlement to act on the referenced object. The PHP tag confirms the server-side language, and the Authentication Bypass tag (though the CWE is strictly authorization rather than authentication) suggests the access control gate is either absent or trivially bypassed.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer was notified via a GitHub issue (https://github.com/imvks786/student_management_system/issues/4) but has not yet responded. As an immediate compensating control, administrators should restrict access to /see.php at the web server or application firewall level, allowing only users with explicitly verified administrative roles - this eliminates exposure to low-privileged users while the root cause is unresolved. A proper code-level fix requires adding a server-side authorization check in /see.php that validates the session user's role before processing any del parameter, e.g., confirming the user holds an 'admin' or 'teacher' role with permission to delete records. Additionally, implementing audit logging on all deletion events would allow detection of unauthorized deletions should exploitation occur before the fix is applied. Organizations running this application in production environments containing real student data should evaluate disabling the deletion endpoint entirely until a patch is confirmed merged and deployed.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today