CVE-2026-82698
Received Received - Intake

Default Password in Student-Management-System

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown function of the file aca.sql. Performing a manipulation results in use of default password. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82698
EUVD
EUVD-2026-68518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sambitraj student-management-system to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1393 The product uses default passwords for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves default administrator credentials embedded in the bundled aca.sql database dump file of the STUDENT-MANAGEMENT-SYSTEM project. The database initialization script creates an administrator account with the username and password set to admin and admin123 respectively. Deployments that import this SQL dump without changing the default credentials are vulnerable to unauthorized administrator access.

Detection Guidance

Check for the presence of the default admin credentials in aca.sql or database dumps. Search for the username 'admin' and password 'admin123' in the file. Verify if the admin_login.php endpoint is accessible and allows login with these credentials.

Impact Analysis

An attacker can exploit this by logging in using the predictable credentials via the admin_login.php endpoint, obtaining a session cookie, and accessing the admin_dashboard.php to perform administrative actions such as managing students, teachers, and results.

Compliance Impact

This vulnerability may violate compliance requirements under GDPR and HIPAA due to unauthorized access risks. Default credentials could allow attackers to access sensitive student or administrative data, leading to potential data breaches. GDPR requires protection of personal data, and HIPAA mandates secure access controls for health-related information. The use of default passwords undermines these safeguards.

Mitigation Strategies

Change the default admin password immediately in the database and application configuration. Remove or update the default credentials in aca.sql. Ensure all deployments use unique, strong passwords for admin accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82698. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart