This vulnerability in ealpha072 Student-Management-System up to commit 01451bd7a2f58cdda07bd0b86e3967582e3ecd08 involves improper authentication in the administrative backend (admin/config.php). Remote attackers can exploit this flaw to bypass authentication mechanisms. The product's rolling release model means specific version numbers are not provided, and no official remediation or patch has been announced by the vendor. Public exploit code is available, but no known active exploitation in the wild has been reported.

Successful exploitation allows remote attackers to bypass authentication controls in the administrative backend, potentially granting unauthorized access to administrative functions. This could lead to unauthorized management or control of the system. The CVSS 4.0 score of 6.9 indicates a medium impact with network attack vector and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, monitor official channels for updates. In the meantime, restrict access to the administrative backend by network controls or other compensating controls to reduce exposure.