CVE-2026-10271

MediumCVSS 6.3/10Last modified Jul 22, 2026

Description

A flaw has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The affected element is an unknown function of the file admin/ of the component Admin Endpoint. This manipulation of the argument uid causes execution after redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-698CWE-705

Affected software

VendorProductVersions
a4m4Student-Management-Systemf0c5f6842c5e8c431ff02b5260a565ca844df3a0

References

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1027108.5In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protecCVE-2026-1027116.9In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizeCVE-2026-1027126.3In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with DTLS server support, the NetX Secure DTLS server's ClientHCVE-2026-1027138.3In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the lengthCVE-2026-1027147.1In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area tCVE-2026-1027157.1In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for CVE-2026-1027168.7In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session heCVE-2026-1027177.5MQTT WebSocket setter ABI mismatch may disclose memory or cause a crashCVE-2026-1027188.7In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the reqCVE-2026-1027196.3In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(),CVE-2026-102726.5A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an CVE-2026-1027205.3In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its rea
CVE-2026-10271: Medium severity, CVSS 6.3 | Vulnix