Description
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in improper authorization. The attack can be initiated remotely.
Published: 2026-08-20
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability permits an attacker to modify the student_id parameter in the add_grade function within index.php, bypassing authorization checks. This flaw enables unauthorized grade changes, compromising the integrity of academic records and potentially granting attackers undue influence over grading outcomes. The weakness is classified as privilege escalation and improper authorization, tying to CWE-266 and CWE-285.

Affected Systems

SourceCodester’s CET Automated Grading System with AI Predictive Analytics version 1.0 is affected. The flaw resides in the add_grade functionality exposed through the system’s index.php page.

Risk and Exploitability

With a CVSS score of 5.3, the vulnerability presents a moderate risk to affected installations. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can remotely target the add_grade endpoint by manipulating request parameters, potentially executing the flaw without authentication if other security controls are absent. The impact is limited to integrity compromise of grade data rather than broader system compromise.

Generated by OpenCVE AI on August 20, 2026 at 21:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch or update to a newer version that addresses the unauthorized grade modification flaw.
  • If no patch exists, enforce strict authentication and role‑based access controls before allowing execution of the add_grade function, ensuring only authorized instructors or administrators can submit grade changes.
  • Remove or protect the direct exposure of the add_grade endpoint in index.php by using access restrictions such as IP whitelisting, HTTP authentication, or route-level security to prevent unauthenticated manipulation.

Generated by OpenCVE AI on August 20, 2026 at 21:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in improper authorization. The attack can be initiated remotely.
Title SourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization
First Time appeared Sourcecodester
Sourcecodester cet Automated Grading System With Ai Predictive Analytics
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:sourcecodester:cet_automated_grading_system_with_ai_predictive_analytics:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester cet Automated Grading System With Ai Predictive Analytics
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Sourcecodester Cet Automated Grading System With Ai Predictive Analytics
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T17:43:57.887Z

Reserved: 2026-08-20T07:20:32.280Z

Link: CVE-2026-76999

cve-icon Vulnrichment

Updated: 2026-08-20T17:43:31.973Z

cve-icon NVD

Status : Received

Published: 2026-08-20T16:18:31.410

Modified: 2026-08-20T18:16:52.850

Link: CVE-2026-76999

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T21:15:05Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization