Vulnerability · Published Feb 22, 2026 · Assigned by VulDB

CVE-2026-2938SourceCodester Student Result Management System update_smtp.php access control

High 7.3

In plain English

A high-severity improper access control in Student Result Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.6%top 48.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in SourceCodester Student Result Management System 1.0. The affected element is an unknown function of the file /srms/script/admin/core/update_smtp.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Student Result Management System	1.0

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-347310 | SourceCodester Student Result Management System update_smtp.php access control vdb-entry
VDB-347310 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #755345 | SourceCodester Student Result Management System 1.0 Improper Access Controls third-party-advisory
https://github.com/Shaon-Xis/SRMS-1.0---Unauthenticated-SMTP-Hijacking-to-Account-Takeover exploit
https://www.sourcecodester.com/ product