The vulnerability CVE-2026-5531 affects SourceCodester Student Result Management System 1.0 and is caused by cleartext storage of sensitive information in the file /login_credentials.txt. This file is accessible through an HTTP GET request handler, allowing remote attackers to retrieve sensitive credentials or data stored in cleartext on disk. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low confidentiality impact. No official patch or vendor remediation level has been provided as of the publication date.

An attacker can remotely access sensitive information stored in cleartext in the /login_credentials.txt file, potentially leading to unauthorized disclosure of credentials or other sensitive data. This could facilitate further attacks or unauthorized access to the system. However, the impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /login_credentials.txt file through web server configuration or network controls to prevent unauthorized remote access. Avoid storing sensitive credentials in cleartext and consider encrypting sensitive data at rest.