Skip to main content

Student-Management-System EUVDEUVD-2026-68515

| CVE-2026-82697 LOW
Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004)
2026-08-31 VulDB GHSA-hxgm-9jp7-9jh3
Information Disclosure Student Management System Sambitraj
2.9
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.9 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

Network-reachable but AC:H reflects XSS chaining requirement; confidentiality limited to session token; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Aug 31, 2026 - 14:22 NVD
MEDIUM LOW
CVSS changed
Aug 31, 2026 - 14:22 NVD
6.3 (MEDIUM) 2.9 (LOW)
Analysis Generated
Aug 31, 2026 - 13:51 vuln.today
CVE Published
Aug 31, 2026 - 13:15 cve.org
MEDIUM 6.3

DescriptionCVE.org

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function session_start. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the session_start function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a separately exploitable cross-site scripting (XSS) vulnerability within the Student-Management-System application to serve as the JavaScript execution vehicle - the missing HttpOnly flag alone does not constitute a standalone exploit. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.3 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) reflects a network-reachable weakness with high attack complexity and limited confidentiality impact - limited to session token exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch is available at time of analysis - the maintainer was notified via a responsible disclosure issue report but has not responded. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Student Management System

View all
CVE-2022-2876 CRITICAL POC
9.8 Aug 18

A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical
CVE-2020-23935 CRITICAL POC
9.8 Aug 20

Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (
CVE-2024-55270 HIGH POC
8.8 Feb 17

phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata
CVE-2024-6191 MEDIUM POC
6.9 Jun 20

A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severi
CVE-2024-5047 MEDIUM POC
6.9 May 17

A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium seve
CVE-2023-3008 CRITICAL
9.8 May 31

A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severi
CVE-2023-3007 CRITICAL
9.8 May 31

A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerab
CVE-2026-10777 MEDIUM POC
5.5 Jun 03

Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to rem
CVE-2026-10619 MEDIUM POC
5.5 Jun 02

Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthentic
CVE-2025-15034 MEDIUM POC
5.5 Dec 23

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands vi
CVE-2025-14967 MEDIUM POC
5.5 Dec 19

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via t
CVE-2025-14661 MEDIUM POC
5.5 Dec 14

SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute

Same weakness CWE-1004 – Sensitive Cookie Without 'HttpOnly' Flag

View all
CVE-2021-3706 HIGH POC
7.5
CVE-2024-6739 MEDIUM POC
6.1
CVE-2022-25172 MEDIUM POC
6.1
CVE-2020-27658 MEDIUM POC
6.1
CVE-2025-26844 CRITICAL
9.8
CVE-2022-4630 MEDIUM POC
5.3
CVE-2021-42115 CRITICAL
9.1
CVE-2026-42239 HIGH
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-68515 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy