An HTTP GET request handler in SourceCodester Student Result Management System version 1.0 writes login credentials to /login_credentials.txt in cleartext when the request is processed. The flaw allows attackers to obtain valid usernames and passwords from the file, compromising the confidentiality of user accounts. The weakness is a classic privilege and data exposure issue, evidenced by the assignment of CWE‑312 and CWE‑313.

The only affected product is SourceCodester Student Result Management System 1.0, which stores credentials on disk during a GET request. No other vendors, products, or versions are listed as impacted.

The vulnerability carries a CVSS score of 6.9, indicating moderate to high risk. No publicly available exploitation probability score is available, and the issue is not listed in the CISA KEV catalog. Attackers can trigger the vulnerability remotely via a crafted HTTP GET request, reading the stored cleartext credentials and potentially gaining unauthorized access to user accounts.