CVE-2026-9438
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In the StudentManagementSystem project (commit cb2f558d), a vulnerability exists in courseDel.php. Manipulation of the ID argument leads to improper control of resource identifiers, enabling remote attack. The exploit has been published.
Risk Assessment
An attacker may gain unauthorized access to data or functions of the student management system, potentially leading to data integrity breaches.
Recommendation
Since the project has not responded, temporarily disable or secure access to courseDel.php and monitor for updates.
Other vulnerabilities in StudentManagementSystem
See all- CVE-2026-9474High
SQL Injection vulnerability in /studentdel.php of StudentManagementSystem (yashpokharna2555). Manipulation of ID argument in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
- CVE-2026-9471Low
A cross-site scripting vulnerability was found in StudentManagementSystem (commit cb2f558d) in the /student.php file via the FIRST_NAME argument. Remote attack is possible. Exploit is publicly available. The project has not responded.
- CVE-2026-9470High
SQL Injection vulnerability in student_trans.php of StudentManagementSystem (yashpokharna2555). Manipulation of FIRST_NAME/Last_Name/EMAIL arguments in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
- CVE-2026-9469High
SQL Injection vulnerability in /success.php of StudentManagementSystem (yashpokharna2555). Manipulation of User argument in an unknown function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
Original NVD description (English source)
A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file courseDel.php. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.