CVE-2026-10272

MediumCVSS 6.5/10Last modified Jul 22, 2026

Description

A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an unknown function of the file admin/deleteform.php. Such manipulation of the argument sid leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-266 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1027205.3A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received CVE-2026-1027216.9A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive pat CVE-2026-1027226.9In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and th CVE-2026-1027236.0NULL Pointer Dereference on MSRP Attribute Table Exhaustion CVE-2026-1027246.0NULL Pointer Dereference When Evicting the Sole MSRP Attribute CVE-2026-1027256.0Out-of-bounds Read from Unvalidated MSRP Attribute List Length CVE-2026-1027266.0Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read CVE-2026-1027276.0FTP Passive Data Connection Not Bound to the Authenticated Control Peer CVE-2026-1027287.5Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is l CVE-2026-1027295.9`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with CVE-2026-102737.3A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the compon CVE-2026-1027308.6Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAN