Is CVE-2026-9562 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9562 being exploited in the wild.

How severe is CVE-2026-9562?

High severity, with a CVSS score of 7.3, published 26 May 2026.

Which products and versions are affected?

Sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.

Is there a fix for CVE-2026-9562?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9562 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9562?

Check whether you run Sambitraj Student Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9562: sambitraj STUDENT-MANAGEMENT-SYSTEM broken access control in dashboards

CVE-2026-9562 · Severity: high · CVSS 7.3 · Published 2026-05-26

A vulnerability in the Student Management System (SMS) allows unauthorized individuals to access administrative dashboards and perform management tasks without logging in. This software is used by schools to track student data, grades, and teacher information. An attacker could exploit this to view sensitive student records or modify and delete school data, potentially leading to significant data breaches or operational disruption.

Technologies: Sambitraj Student Management System. Vendors: Sambitraj.

Quick answers

Is CVE-2026-9562 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9562 being exploited in the wild.
How severe is CVE-2026-9562?: High severity, with a CVSS score of 7.3, published 26 May 2026.
Which products and versions are affected?: Sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.
Is there a fix for CVE-2026-9562?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9562 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9562?: Check whether you run Sambitraj Student Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability exists in the sambitraj STUDENT-MANAGEMENT-SYSTEM through commit 56ba287. The application fails to implement session validation checks across multiple PHP scripts, including admin_dashboard.php, student_dashboard.php, and teacher_dashboard.php, as well as CRUD operation scripts like add_student.php and delete_student.php. While these files initiate a session via session_start(), they do not verify the existence of a valid session variable (e.g., $_SESSION['email']). A remote, unauthenticated attacker can bypass the login mechanism by directly requesting these URLs, gaining full access to administrative, teacher, and student functionalities. As of the advisory date, no patch has been released by the maintainer.

Affected products

sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5

Timeline

2026-04-29: disclosed: Issue reported on GitHub by user duckpigdog
2026-05-26: advisory: NVD/VulDB advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.