Is CVE-2026-10272 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10272 being exploited in the wild.

How severe is CVE-2026-10272?

Medium severity, with a CVSS score of 6.5, published 1 June 2026.

Which products and versions are affected?

a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0.

Is there a fix for CVE-2026-10272?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10272 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10272?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10272: a4m4 Student-Management-System improper authorization in admin/deleteform.php

CVE-2026-10272 · Severity: medium · CVSS 6.5 · Published 2026-06-01

A vulnerability exists in the a4m4 Student-Management-System, a web application used for managing student records. Due to a lack of security checks, unauthorized individuals can remotely delete student data from the system. This could lead to significant data loss, operational disruption, and a loss of data integrity within the organization.

Quick answers

Is CVE-2026-10272 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10272 being exploited in the wild.
How severe is CVE-2026-10272?: Medium severity, with a CVSS score of 6.5, published 1 June 2026.
Which products and versions are affected?: a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0.
Is there a fix for CVE-2026-10272?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10272 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10272?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as Improper Authorization (CWE-285) and Incorrect Privilege Assignment (CWE-266) within the 'admin/deleteform.php' script. The root cause is a complete absence of session validation or authentication checks (such as session_start()) before processing database operations. An attacker can send a specially crafted HTTP GET or POST request with a 'sid' parameter to the vulnerable endpoint to execute a SQL DELETE statement against the 'student' table. This allows for unauthenticated, remote, arbitrary data deletion. As of the advisory date, the vendor has not responded to the issue report, and no official patch is available.

Affected products

a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0

Timeline

2026-05-11: disclosed: Issue reported on GitHub repository
2026-06-01: advisory: NVD/VulDB advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.