CVE-2026-125077
Deferred Deferred - Pending Action

Cross-Site Request Forgery in Smart Attendance System with QR Code Scanner

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulDB

Description
A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125077
EUVD
EUVD-2026-120653

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SourceCodester Smart Attendance System with QR Code Scanner 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-125077 is a Cross-Site Request Forgery (CSRF) vulnerability in Smart Attendance System with QR Code Scanner 1.0. It allows attackers to delete student records and attendance history by tricking an authenticated administrator into visiting a malicious page. The system lacks CSRF protection and uses GET requests for destructive actions, which browsers execute automatically.

Detection Guidance

To detect this CSRF vulnerability, inspect network traffic for suspicious GET requests to delete_student.php from authenticated admin sessions. Check web server logs for repeated or unusual deletion requests. Review application code for absence of CSRF tokens or confirmation prompts in state-changing operations.

Impact Analysis

An attacker could silently delete student data and attendance records. This could disrupt operations, cause data loss, and require manual recovery. The attack can be triggered remotely without direct access to the system.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, violating GDPR's integrity principle and HIPAA's access controls. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately enforce POST requests for destructive actions like student deletion. Implement CSRF tokens in all state-changing forms. Add same-origin checks to prevent cross-origin requests. Disable or restrict access to delete_student.php until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...