CVE-2026-82553: sambitraj Student Management System Student Dashboard student_dashboard.php mysqli_query improper authorization
A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqliquery of the file studentdashboard.php of the component Student Dashboard. The manipulation of the argument rollno results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable with low privileges and requires no user interaction. Exploitation involves manipulating the roll_no argument handled by student_dashboard.php.
Is public exploit code available?
Yes. The exploit is public, which increases the likelihood that the issue may be used in attacks.
Which releases are affected?
The issue affects the project through commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The product uses a rolling release model, so affected or fixed release version numbers are not disclosed.
Is a fix available from the project?
The project was notified through an issue report but had not responded at the time of the report. No vendor-provided remediation is identified in the available data.