A weakness in the Student Record Handler of imvks786's student_management_system, specifically the /add.php endpoint, allows an attacker to bypass standard access controls and modify or add student records. The flaw arises from insufficient authorization checks and can be exploited remotely, and public exploit code is available. This vulnerability corresponds to CWE-266 and CWE-284 and could compromise data integrity.

The affected product is imvks786:student_management_system, but no exact version is published because the project employs a rolling release model. The vulnerable function resides in add.php and is present in any build older than commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Because the repository does not publish discrete release versions, administrators must check the current codebase against this commit identifier to determine exposure.

The CVSS score of 5.3 indicates moderate risk; EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog. The attacker can trigger the flaw remotely via crafted HTTP requests to /add.php, and exploitation is publicly available, implying that the likelihood of breach remains significant for systems that have not addressed the access control oversight.