CVE-2026-10777

ealpha072 Student-Management-System Administrative Backend config.php improper authentication

View on CVE.org
Published Jun 3, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The vulnerability is triggered by an insufficient authentication check in the admin/config.php file of the Student‑Management‑System. This flaw allows an unauthenticated or low‑privileged user to gain administrative access by manipulating requests or bypassing the expected authentication workflow. As a result, an attacker could read, modify, or delete configuration settings, potentially leading to a full compromise of the management system.

Affected Systems

The affected product is ealpha072 Student‑Management‑System, up to the code revision 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. The public repository contains the vulnerable component in the Administrative Backend, but the project does not publish explicit version numbers for releases due to its rolling‑release model.

Risk and Exploitability

The CVSS score of 6.9 classifies the flaw as a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation campaigns at the time of writing. However, the exploit code is publicly available, and the vulnerability can be triggered remotely, making it a realistic threat for exposed instances of the application.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict external access to the administrative backend using firewall rules or IP whitelisting to limit the attack surface.
  • Enable detailed logging for authentication attempts and monitor logs for suspicious access patterns, alerting on repeated failures or unexpected user agents.
  • When a vendor patch or update becomes available, upgrade the Student‑Management‑System to a version that removes the improper authentication check; meanwhile, verify the running code against the commit hash to confirm vulnerability status.

Generated by OpenCVE AI on June 4, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Title ealpha072 Student-Management-System Administrative Backend config.php improper authentication
First Time appeared Ealpha072
Ealpha072 student-management-system
Weaknesses CWE-287
CPEs cpe:2.3:a:ealpha072:student-management-system:*:*:*:*:*:*:*:*
Vendors & Products Ealpha072
Ealpha072 student-management-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jun 4, 2026, 12:52 PM
Reserved
Jun 3, 2026, 3:54 PM

View source JSON

Updated
Jun 4, 2026, 12:48 PM

JSON

Status
Deferred
Published
Jun 3, 2026, 11:16 PM
Modified
Jul 22, 2026, 8:10 PM

View source JSON

No data.

Updated
Jun 5, 2026, 10:11 AM

JSON