# CVE-2026-9486: SourceCodester Student Grades Management System CSRF

Source: https://junglewise.ai/threats/cve-2026-9486-sourcecodester-student-grades-management-system-csrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9486 · Severity: medium · CVSS 4.3 · Published 2026-05-25

The Student Grades Management System, a web application used for tracking academic performance, is vulnerable to a security flaw that allows unauthorized actions. By tricking an authenticated user (such as a teacher or administrator) into clicking a malicious link, an attacker can perform actions on their behalf without their consent. This could lead to unauthorized changes to student records or system settings, potentially compromising the integrity of academic data.

Technologies: [SourceCodester Student Grades Management System](https://junglewise.ai/threats/technologies/student-grades-management-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-9486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9486 being exploited in the wild.

**How severe is CVE-2026-9486?** Medium severity, with a CVSS score of 4.3, published 25 May 2026.

**Which products and versions are affected?** SourceCodester Student Grades Management System 1.0.

**Is there a fix for CVE-2026-9486?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9486 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9486?** Check whether you run SourceCodester Student Grades Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in SourceCodester Student Grades Management System 1.0 due to missing authorization checks and lack of anti-CSRF tokens. An attacker can exploit this by crafting a malicious web page or link that, when visited by an authenticated user, triggers unintended requests to the application. Because the application fails to verify that the request was intentionally initiated by the user, the attacker can perform state-changing operations (such as modifying grades or user accounts) with the privileges of the victim. The attack requires network connectivity to the application and minimal user interaction. Public exploit documentation has been released.

## Affected products

- SourceCodester Student Grades Management System 1.0

## Timeline

- 2026-05-25: disclosed: Vulnerability reported and exploit released publicly.
- 2026-05-25: advisory: NVD and VulDB published advisory details.

## References

- [https://github.com/Jack-MRJ/Student-Grades-Management-System-Vulnerability-Report](https://github.com/Jack-MRJ/Student-Grades-Management-System-Vulnerability-Report)
- [https://vuldb.com/submit/814044](https://vuldb.com/submit/814044)
- [https://vuldb.com/vuln/365467](https://vuldb.com/vuln/365467)
- [https://vuldb.com/vuln/365467/cti](https://vuldb.com/vuln/365467/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Student Grades Management System XSS in students.php](https://junglewise.ai/threats/cve-2026-9485-sourcecodester-student-grades-management-system-xss-in-students)
- [SourceCodester Student Grades Management System improper authorization in classroom.php](https://junglewise.ai/threats/cve-2026-9484-sourcecodester-student-grades-management-system-improper)
- [SourceCodester Student Grades Management System improper authorization in grades.php](https://junglewise.ai/threats/cve-2026-9483-sourcecodester-student-grades-management-system-improper)
- [SourceCodester Student Grades Management System stored XSS in classroom.php](https://junglewise.ai/threats/cve-2025-63892-sourcecodester-student-grades-management-system-stored-xss-in)