EUVD-2026-86498
GHSA-p422-4957-2v76
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed student-management-system instance
-
ExploitRetrieve default credentials from example_lite.sql
-
ExecutionAuthenticate remotely with default admin login
-
ImpactAccess and control application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default credential prevention
|
| Exploitation Conditions | Requires that the deployed instance retains the default credentials shipped in the example_lite.sql seed file - i.e., the administrator initialized the database from example_lite.sql and never changed the default account password. Exploitation is remote over the network with no user interaction, but is entirely gated on this insecure default configuration persisting; any operator who changed the credentials is not affected. Impact scope is limited by the fact that this is an obscure, rarely-deployed hobby project. |
| Impact | This is a low-priority, low-confidence finding despite the moderate 5.1 CVSS 4.0 score. The vulnerability is CWE-1392 (use of default credentials) seeded via the example_lite.sql database file in an obscure GitHub PHP hobby project (ningzichun/student-management-system) with no enterprise deployment footprint. Exploitation status: publicly available exploit code exists (GitHub issue #13), but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. The vendor's CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N/VC:L/VI:L/VA:L) is internally inconsistent for a default-credentials flaw: PR:H is questionable because default credentials are precisely what an UNAUTHENTICATED attacker uses to GAIN access - logging in with a shipped default admin password should be modeled as PR:N, and success typically grants full administrative control rather than the LOW impacts VulDB assigned. This is a classic low-signal VulDB batch submission (vuln/409751) against a non-responsive hobby project; real-world risk is bounded almost entirely by the product's near-zero prevalence, not by the technical severity. |
| Exploit ScenarioDerived | An attacker locates a publicly reachable deployment of the student-management-system whose administrator never changed the credentials shipped in example_lite.sql, then logs in remotely using those known default credentials to obtain administrative access. A public proof-of-concept exists (GitHub issue #13), lowering the barrier to exploitation, though success is entirely contingent on the operator having left default credentials in place. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Default-credential exposure in ningzichun's student-management-system allows remote attackers to authenticate with the administrator password shipped in the example_lite.sql seed file, obtaining full access to the application's administrative functionality and stored data. The flaw affects all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf, and publicly available exploit code exists, though no CISA KEV listing or other confirmation of active exploitation is present. Exploitation is entirely gated on the operator having initialized the database from example_lite.sql and never rotated the seeded account password; given that this is an obscure, rarely deployed hobby project, overall real-world risk is low despite the moderate 5.1 CVSS 4.0 score.
RemediationAI
No vendor-released patch was identified at the time of analysis, and the upstream project has not responded to the issue report, so remediation must be operator-driven. The primary action is to eliminate the default credentials: after deployment, change the seeded account password (or delete and recreate the account) before the instance is reachable on any network, and re-scan any existing installation whose database was initialized from example_lite.sql for accounts that still use the shipped password. Because there is no upstream fix to upgrade to, rely on compensating controls: keep instances off the public internet and restrict the login endpoint to a trusted management network or VPN, accepting that this removes legitimate remote access for end users; or, if internet exposure is required, enforce network-level authentication or a reverse-proxy access list in front of the application and apply login rate limiting-understanding that rate limiting only slows credential stuffing and does not remove the underlying default-credential risk. Monitoring application authentication logs for successful logins by the seeded account, and for repeated login attempts, provides detection while remediation is staged. Track the upstream repository and the VulDB advisory (https://vuldb.com/vuln/409751) for a future patched revision, and note that publicly available exploit code exists for this issue, so unpatched and unhardened instances should be considered compromised until the default credentials are rotated.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-1392 (Use of Default Credentials): the project's example_lite.sql database seed script creates an account with a hard-coded, publicly documented password, and the application provides no forced first-login credential change or other safeguard. An attacker who can reach the login endpoint simply supplies those known credentials and gains the privileges of that seeded account. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/E:P) reflects network reachability, low attack complexity, and proof-of-concept exploit maturity (E:P), while our independent assessment rates the same issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, treating the credential-based login as requiring no prior privileges and assigning high confidentiality, integrity, and availability impact because successful login yields administrative control. The CPE cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:* carries no version constraints, confirming that affectedness is defined by the snapshot/commit lineage rather than a tagged release, with everything up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf in scope. No underlying memory-safety, injection, or cryptographic primitive is involved - the entire issue is insecure default configuration combined with remote reachability of the authentication service.
Know when Student Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Default credentials let an unauthenticated remote attacker log in (PR:N), granting full application/admin control (C/I/A:H); AC:L since credentials are published, though gated on defaults being unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is an unknown functionality of the file example_lite.sql. Executing a manipulation can lead to use of default credentials. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in ningzichun student-management-system Multiple Flaws
View all 5More in Student Management System
View allA vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (
phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata
A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severi
A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium seve
Time-based blind SQL injection in krishanmurariji Student Management System 1.0 lets an attacker who can reach the /stud
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severi
A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerab
Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to rem
Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthentic
Exploit-DB