The vulnerability resides in the courseDel.php file of the StudentManagementSystem. By manipulating the ID argument, an attacker can inject arbitrary resource identifiers, enabling unauthorized control over deletion or modification of resources. This flaw is classified as input validation failure (CWE‑99). The public exploit makes the attack remote, potentially allowing a malicious actor to delete or tamper with course records without authentication. The impact is loss of integrity and availability of course data.

Affected product is yashpokharna2555:StudentManagementSystem. No specific version information is available because the project uses a rolling release model, so any active deployment of the current repository revision is potentially vulnerable.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, so the likelihood of exploitation remains uncertain, and the vulnerability is not listed in CISA KEV. Attackers can target the publicly exposed endpoint, but the lack of an available patch and the project's unresponsive support highlight the need for mitigation. The absence of a definitive exploitation path or known active exploitation trends reduces the immediacy, yet the remote nature of the attack keeps the risk moderate.