CVE-2026-86674: ningzichun Student Management System login.php session_start session fixiation
A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the function sessionstart of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as potentially affected?
Deployments of ningzichun Student Management System at or before commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf should be treated as potentially affected. The product does not use versioning, so affected and unaffected release boundaries are not available.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges, but user interaction is required. Public exploit information is available.
Is a vendor fix available?
No response from the project is reported after it was notified through an issue report. The available information does not identify a fixed release or commit.