Is CVE-2026-125077 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125077 being exploited in the wild.

How severe is CVE-2026-125077?

Medium severity, with a CVSS score of 4.3, published 10 November 2026.

How is CVE-2026-125077 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125077?

Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125077: SourceCodester Smart Attendance System cross-site request forgery in student deletion

CVE-2026-125077 · Severity: medium · CVSS 4.3 · Published 2026-11-10

SourceCodester Smart Attendance System is a web application used to manage student records and attendance via QR codes. A cross-site request forgery vulnerability allows an attacker to silently delete student records and their attendance history by tricking an authenticated administrator into visiting a malicious page, potentially wiping the entire student directory.

Technologies: SourceCodester Smart Attendance System with QR Code Scanner. Vendors: SourceCodester.

Quick answers

Is CVE-2026-125077 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125077 being exploited in the wild.
How severe is CVE-2026-125077?: Medium severity, with a CVSS score of 4.3, published 10 November 2026.
Which products and versions are affected?: SourceCodester Smart Attendance System with QR Code Scanner 1.0.
Is there a fix for CVE-2026-125077?: No fixed version is recorded yet. Restrict administrator access to trusted networks via IP allowlisting or firewall rules. Convert all destructive operations (DELETE, UPDATE) from GET to POST requests, implement CSRF tokens in all state-changing operations, and add Origin/Referer header validation to validate requests originate from the same domain. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125077 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125077?: Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict administrator access to trusted networks via IP allowlisting or firewall rules. Convert all destructive operations (DELETE, UPDATE) from GET to POST requests, implement CSRF tokens in all state-changing operations, and add Origin/Referer header validation to validate requests originate from the same domain.

Technical details

The vulnerability exists in delete_student.php which accepts student deletion via GET requests without CSRF tokens, Origin/Referer validation, or confirmation. An unauthenticated attacker can craft a malicious page with an embedded image or iframe that triggers a DELETE operation when visited by a logged-in administrator, cascading to related attendance records. No fix is currently available.

Affected products

SourceCodester Smart Attendance System with QR Code Scanner 1.0

Timeline

2026-10-17: disclosed: Vulnerability identified during security audit
2026-11-10: advisory: CVE-2026-125077 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.