This vulnerability in the a4m4 Student-Management-System up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0 allows remote attackers to manipulate the uid argument in an unknown function within the admin/ endpoint, causing execution after redirect. Multiple endpoints are affected. The system uses a rolling release model, so no fixed version is currently identified. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, user interaction required, and low impacts on confidentiality, integrity, and availability. The vendor has not yet provided a remediation or patch.

The vulnerability allows remote attackers to cause execution after redirect by manipulating the uid argument in the admin endpoint, potentially enabling limited unauthorized actions or workflow bypasses. The impact is rated medium with low confidentiality, integrity, and availability impacts. No known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor. Until a patch is released, consider restricting access to the affected admin endpoints and applying any available web application firewall rules that might mitigate exploitation of redirect-related flaws.