This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows remote attackers to bypass authorization controls by manipulating the 'Name' parameter in an HTTP POST request to /viva/update.php. The improper authorization could lead to unauthorized actions within the system. The vulnerability is publicly disclosed, but the vendor has not responded or provided a fix. The rolling release nature of the product complicates version tracking and patch availability. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation could allow remote attackers to perform unauthorized operations within the Student-Management-System due to improper authorization checks. The exact impact depends on the functionality exposed by the vulnerable endpoint, but it may lead to unauthorized data modification or other unauthorized actions. There is no current evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the Cyber-III project. Until a fix is released, consider restricting access to the vulnerable endpoint or implementing additional access controls if possible.