A flaw in the grades.php file of the Student Grades Management System permits an attacker to manipulate the student_id argument, bypassing normal authorization checks. This can allow unauthenticated users to view or modify grades that do not belong to them, leading to a breach of confidentiality and potential integrity violations of student data.

The vulnerability affects SourceCodester Student Grades Management System version 1.0. The weakness resides in grades.php, which handles grading information for individual students.

With a CVSS score of 5.3, the risk is moderate. The EPSS score is currently unavailable, but the vulnerability is publicly documented and can be exploited remotely by sending crafted requests that alter the student_id parameter. Since the vulnerability is not listed in the CISA KEV catalog, no immediate high‑profile exploitation events have been reported yet, yet the public nature of the exploit means it is feasible for adversaries to use it against vulnerable installations.