CVE-2026-9582
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The attack can be performed remotely, and the exploit has been publicly released.
Risk Assessment
An attacker can force an authenticated user to perform unwanted actions in the system, such as changing configuration or deleting data.
Recommendation
Implement CSRF protection mechanisms such as anti-CSRF tokens and update the system if a patch is available.
Other vulnerabilities in SourceCodester CET Automated Grading System
See all- CVE-2026-76999Medium
The vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 concerns improper authorization in the add_grade function in /index.php. Manipulation of the student_id argument allows unauthorized access, and the attack can be initiated remotely.
- CVE-2026-14609Medium
A session fixation vulnerability was found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The attack can be executed remotely but requires high complexity and is considered difficult. The exploit is publicly available.
- CVE-2026-14608Medium
A security vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0, allowing authorization bypass via manipulation of the ID argument in the POST request to /index.php?action=view_student. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-9583Medium
A weakness in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 was found in the /index.php file of the SQL Handler component. Manipulation can lead to information exposure through error messages.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects an unknown function. Performing a manipulation results in cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.