CVE-2026-9438

MediumCVSS 5.4/10Last modified Jul 23, 2026

Description

A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file courseDel.php. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-99

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-943818.7MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let CVE-2026-943824.2Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that CVE-2026-943838.6The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only san CVE-2026-943848.1Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission CVE-2026-943875.4Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value e CVE-2026-943889.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-p CVE-2026-943899.0Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.CVE-2026-94396.3A vulnerability was determined in Edimax BR-6675nD 1.12. Affected is the function stainfo of the file /goform/stainfo. This manipulation of CVE-2026-943907.2Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.CVE-2026-943916.5Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.CVE-2026-943936.4When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether CVE-2026-943946.3When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does n