CVE-2026-2983

A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/import_users.php of the component Bulk Import. This manipulation of the argument File causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

• CWE-266
• CWE-284

• https://github.com/Shaon-Xis/SRMS-1.0---Unauthenticated-SMTP-Hijacking-to-Account-Takeover#-vulnerability-2-unauthenticated-bulk-account-injection-arbitrary-file-uploadExploit, Mitigation, Third Party Advisory
• https://vuldb.com/?ctiid.347366Permissions Required, VDB Entry
• https://vuldb.com/?id.347366Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.756135Third Party Advisory, VDB Entry
• https://www.sourcecodester.com/Product

Published

Feb 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29794Vikunja is an open-source self-hosted task management platfo…5.3
• CVE-2026-29795stellar-xdr is a library and CLI containing types and functi…7.5
• CVE-2026-29796WebSocket endpoints lack proper authentication mechanisms, e…9.8
• CVE-2026-2980A vulnerability has been found in UTT HiPER 810G up to 1.7.7…7.3
• CVE-2026-2981A vulnerability was found in UTT HiPER 810G up to 1.7.7-1711…8.8
• CVE-2026-29828DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerabili…6.1
• CVE-2026-29839DedeCMS v5.7.118 was discovered to contain a Cross-Site Requ…8.8
• CVE-2026-2984A vulnerability was identified in SourceCodester Student Res…6.5
• CVE-2026-29840JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scri…5.4
• CVE-2026-2985A security flaw has been discovered in Tiandy Video Surveill…6.3
• CVE-2026-29856An issue in the VirtualHost configuration handling/parser co…7.5
• CVE-2026-29858A lack of path validation in aaPanel v7.57.0 allows attacker…7.5