A flaw in the student-management-system allows an attacker to manipulate request parameters to bypass the authentication process, enabling unauthorized access to user accounts and sensitive data. The vulnerability affects an unknown function and is exploitable remotely, as public exploits are available for multiple endpoints. This improper authentication can compromise confidentiality and integrity of the system’s data and allow malicious users to perform any actions permitted to legitimate accounts.

The issue impacts all versions of sayan365 student‑management‑system up to commit 7f3c9ce7d410332335c2affac93a385485051800, with no precise version guidance due to the project’s rolling‑release delivery model.

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is remotely exploitable with a public exploit currently available. Although EPSS data is missing and the vulnerability is not listed in CISA KEV, the existence of multiple affected endpoints and the ability to bypass authentication elevate the risk. The likely attack vector is a remote attacker sending crafted requests to the application’s login or related authentication endpoints, as inferred from the description.