CVE-2026-76999
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 concerns improper authorization in the add_grade function in /index.php. Manipulation of the student_id argument allows unauthorized access, and the attack can be initiated remotely.
Risk Assessment
The risk is the potential for unauthorized modification of grades or access to data by a remote attacker, potentially compromising the integrity of the grading system.
Recommendation
It is recommended to apply patches or updates to the system and strengthen authorization mechanisms for the add_grade function.
Other vulnerabilities in SourceCodester CET Automated Grading System
See all- CVE-2026-14609Medium
A session fixation vulnerability was found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The attack can be executed remotely but requires high complexity and is considered difficult. The exploit is publicly available.
- CVE-2026-14608Medium
A security vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0, allowing authorization bypass via manipulation of the ID argument in the POST request to /index.php?action=view_student. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-9583Medium
A weakness in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 was found in the /index.php file of the SQL Handler component. Manipulation can lead to information exposure through error messages.
- CVE-2026-9582Medium
A Cross-Site Request Forgery (CSRF) vulnerability has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The attack can be performed remotely, and the exploit has been publicly released.
Original NVD description (English source)
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in improper authorization. The attack can be initiated remotely.