A flaw was discovered in SourceCodester Student Grades Management System 1.0 that allows an attacker to perform a cross‑site request forgery. The flaw permits the execution of unintended state‑changing or data‑retrieval actions by a victim’s authenticated session, potentially leading to unauthorized modification of grades or disclosure of sensitive information. The vulnerability is modeled after CWE‑352 and is further complicated by a lack of proper authentication checks (CWE‑862).

The only affected product listed is SourceCodester Student Grades Management System version 1.0. The specific module or feature affected is not named, but the issue resides within the core application code of this release.

The CVSS base score of 5.3 indicates moderate severity. EPSS data is not available, so the exploitation probability cannot be precisely quantified. The vulnerability is not in the CISA KEV catalog, but a public exploit has been released, and it can be triggered remotely through a web browser. Therefore, the likely attack vector is inferred to require access to a victim’s session or the ability to inject crafted requests from a web page.