Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Ningzichun Student Management System lets unauthorized log edits

CVE-2026-97647 · published 1 month ago
Summary

The editLog page in the Ningzichun Student Management System can be accessed from outside the network and allows changes to log entries without proper permission. An attacker could modify or add log information, which may hide their activity or corrupt records. Apply the latest software update or restrict access to this page until a fix is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ningzichun student-management-system 98760f5711cf6dc8b4adca53a9e207ca49b02ebf
Original advisory text
ningzichun student-management-system editLog.php authorization
A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-285Improper Authorization
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published25 Sep 2026
Updated31 Oct 2026
First seen25 Sep 2026
Sources
CVE-2026-97647 · NVD
CVE-2026-97647 · MITRE
CVE-2026-97647 · OSV
Track software like this
Free during beta