Is CVE-2026-82697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82697 being exploited in the wild.

How severe is CVE-2026-82697?

Low severity, with a CVSS score of 3.7, published 31 August 2026.

Which products and versions are affected?

Sambitraj Student Management System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.

Is there a fix for CVE-2026-82697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82697 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82697?

Check whether you run Sambitraj Student Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82697: sambitraj Student-Management-System insecure session cookie in login

CVE-2026-82697 · Severity: low · CVSS 3.7 · Published 2026-08-31

Student-Management-System is a school administration tool that manages student grades, teacher records, and academic data. A vulnerability in its login and dashboard pages fails to set the HttpOnly flag on session cookies, allowing attackers with JavaScript access (via XSS) to steal session IDs and impersonate users. This could lead to unauthorized access to student records, grade modifications, and administrative functions.

Technologies: Sambitraj Student Management System. Vendors: Sambitraj.

Quick answers

Is CVE-2026-82697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82697 being exploited in the wild.
How severe is CVE-2026-82697?: Low severity, with a CVSS score of 3.7, published 31 August 2026.
Which products and versions are affected?: Sambitraj Student Management System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.
Is there a fix for CVE-2026-82697?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82697 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82697?: Check whether you run Sambitraj Student Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cookie security configuration defect: the application calls session_start() in login flows (admin_login.php, student_login.php, teacher_login.php) and dashboard pages without configuring the session.cookie_httponly setting or using session_set_cookie_params() to set httponly=true. This results in PHPSESSID cookies issued without the HttpOnly flag, making them readable by JavaScript. While not directly exploitable over the network, when combined with XSS vulnerabilities (such as the existing stored XSS in issue #3), an attacker can steal the session cookie via document.cookie and perform session hijacking. No patch has been released; the project operates on rolling releases and has not responded to the disclosure.

Affected products

sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5

Timeline

2026-07-17: disclosed: Vulnerability reported on GitHub issue #10
2026-08-31: advisory: Published to NVD as CVE-2026-82697

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.