This vulnerability involves improper authorization in the imvks786 student_management_system's /see.php file, specifically in the Student Deletion Endpoint. Manipulation of the 'del' parameter can bypass authorization controls, enabling unauthorized remote deletion actions. The product's rolling release model means no discrete version numbers are provided for affected or patched states. The vendor has not yet responded or issued a fix. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability to perform unauthorized deletion of student records via the 'del' argument in the /see.php endpoint. This could lead to data loss or disruption of student management functions. The impact is limited to improper authorization without elevation of privileges or user interaction required. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor for updates from the vendor. Until a fix is available, consider restricting access to the /see.php endpoint or implementing additional access controls to limit unauthorized deletion attempts.