CVE-2026-9484
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In SourceCodester Student Grades Management System 1.0, an improper authorization vulnerability exists in the getClassroomStudents/removeStudentFromClassroom function of classroom.php. Manipulating the classroom_id argument leads to authorization bypass. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can unauthorizedly delete or view student data, threatening the integrity and confidentiality of the grading system.
Recommendation
Update Student Grades Management System to a patched version or implement proper access control for classroom.php functions.
Other vulnerabilities in Student Grades Management System
See all- CVE-2026-9483Medium
SourceCodester Student Grades Management System 1.0 has a vulnerability in grades.php where manipulation of the student_id argument leads to improper authorization. The attack can be performed remotely and the exploit is public.
- CVE-2025-11485Low
A vulnerability in SourceCodester Student Grades Management System 1.0 affects the add_user function in /admin.php of the Manage Users Page component. Manipulation of first_name/last_name arguments causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/removeStudentFromClassroom of the file classroom.php. Executing a manipulation of the argument classroom_id can lead to improper authorization. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS