CVE-2026-14609
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A session fixation vulnerability was found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The attack can be executed remotely but requires high complexity and is considered difficult. The exploit is publicly available.
Risk Assessment
The organization is at risk of session hijacking, potentially leading to unauthorized access to user data and system functions.
Recommendation
Immediately update the system to the latest version or apply temporary mitigations such as regenerating session IDs after login.
Other vulnerabilities in SourceCodester CET Automated Grading System
See all- CVE-2026-76999Medium
The vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 concerns improper authorization in the add_grade function in /index.php. Manipulation of the student_id argument allows unauthorized access, and the attack can be initiated remotely.
- CVE-2026-14608Medium
A security vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0, allowing authorization bypass via manipulation of the ID argument in the POST request to /index.php?action=view_student. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-9583Medium
A weakness in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 was found in the /index.php file of the SQL Handler component. Manipulation can lead to information exposure through error messages.
- CVE-2026-9582Medium
A Cross-Site Request Forgery (CSRF) vulnerability has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The attack can be performed remotely, and the exploit has been publicly released.
Original NVD description (English source)
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The manipulation results in session fixiation. The attack can be executed remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.