CVE-2026-124502

MediumCVSS 4.3/10Last modified Nov 12, 2026

Description

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862 CWE-863

Affected software

Vendor	Product	Versions
yungifez	Skuul School Management System	2.6.0; 2.6.1; 2.6.2; 2.6.3

References

Timeline

Published: Nov 9, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1245034.3A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/m CVE-2026-1245046.3A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file Repor CVE-2026-1245054.3A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the compon CVE-2026-1245064.3A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This vulnerability affects the function Model.getDomain of the file WEB-CVE-2026-1245075.3A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowS CVE-2026-1245085.3A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/j CVE-2026-1245097.3A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file serv CVE-2026-124518.3Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer pro CVE-2026-124528.8Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corrup CVE-2026-124534.2Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised t CVE-2026-124548.3Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to CVE-2026-124557.5Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI