CVE-2026-10169

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10169", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-30T09:31:06.603Z", "datePublished": "2026-05-31T04:45:06.943Z", "dateUpdated": "2026-06-02T02:20:35.063Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-31T04:45:06.943Z"}, "title": "OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-640", "lang": "en", "description": "Weak Password Recovery"}]}], "affected": [{"vendor": "OUSL-GROUP-BrinaryBrains", "product": "School Student Management System", "versions": [{"version": "1e70e5ad1125b86dca4ee086eb6bb121f17708b6", "status": "affected"}], "cpes": ["cpe:2.3:a:ousl-group-brinarybrains:school_student_management_system:*:*:*:*:*:*:*:*"], "modules": ["Forgot Password Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Affected by this vulnerability is the function ajax_forgot_password of the file application/controllers/Login.php of the component Forgot Password Endpoint. The manipulation of the argument email results in weak password recovery. The attack can be launched remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-05-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-30T11:36:16.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "seventeenss (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/367423", "name": "VDB-367423 | OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/367423/cti", "name": "VDB-367423 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/819395", "name": "Submit #819395 | OUSL-GROUP-BrinaryBrains School-Student-Management-System 1.0 Account Enumeration and Arbitrary Password Reset in Forgot Passw", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OUSL-GROUP-BrinaryBrains/School-Student-Management-System/issues/26", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T02:20:22.252882Z", "id": "CVE-2026-10169", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T02:20:35.063Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery", "credits": [{"lang": "en", "type": "reporter", "value": "seventeenss (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:ousl-group-brinarybrains:school_student_management_system:*:*:*:*:*:*:*:*"], "vendor": "OUSL-GROUP-BrinaryBrains", "modules": ["Forgot Password Endpoint"], "product": "School Student Management System", "versions": [{"status": "affected", "version": "1e70e5ad1125b86dca4ee086eb6bb121f17708b6"}]}], "timeline": [{"lang": "en", "time": "2026-05-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-30T11:36:16.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/367423", "name": "VDB-367423 | OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/367423/cti", "name": "VDB-367423 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/819395", "name": "Submit #819395 | OUSL-GROUP-BrinaryBrains School-Student-Management-System 1.0 Account Enumeration and Arbitrary Password Reset in Forgot Passw", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OUSL-GROUP-BrinaryBrains/School-Student-Management-System/issues/26", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Affected by this vulnerability is the function ajax_forgot_password of the file application/controllers/Login.php of the component Forgot Password Endpoint. The manipulation of the argument email results in weak password recovery. The attack can be launched remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "Weak Password Recovery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-31T04:45:06.943Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10169", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T02:20:22.252882Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-06-02T02:20:31.067Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-10169", "state": "PUBLISHED", "dateUpdated": "2026-05-31T04:45:06.943Z", "dateReserved": "2026-05-30T09:31:06.603Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-31T04:45:06.943Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ousl-group-brinarybrains:school_student_management_system:*:*:*:*:*:*:*:*"], "modules": ["Forgot Password Endpoint"], "product": "School Student Management System", "vendor": "OUSL-GROUP-BrinaryBrains", "versions": [{"status": "affected", "version": "1e70e5ad1125b86dca4ee086eb6bb121f17708b6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Affected by this vulnerability is the function ajax_forgot_password of the file application/controllers/Login.php of the component Forgot Password Endpoint. The manipulation of the argument email results in weak password recovery. The attack can be launched remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en el Sistema de Gesti\u00f3n de Estudiantes OUSL-GROUP-BrinaryBrains School hasta 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Afectada por esta vulnerabilidad es la funci\u00f3n ajax_forgot_password del archivo application/controllers/Login.php del componente Forgot Password Endpoint. La manipulaci\u00f3n del argumento email resulta en una recuperaci\u00f3n de contrase\u00f1a d\u00e9bil. El ataque puede ser lanzado remotamente. Este ataque se caracteriza por una alta complejidad. La explotaci\u00f3n parece ser dif\u00edcil. El exploit es ahora p\u00fablico y puede ser usado. Este producto no utiliza versionado. Esta es la raz\u00f3n por la cual la informaci\u00f3n sobre las versiones afectadas y no afectadas no est\u00e1 disponible. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema pero a\u00fan no ha respondido."}], "id": "CVE-2026-10169", "lastModified": "2026-07-22T07:10:00.107", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10169", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T02:20:22.252882Z", "version": "2.0.3"}}]}, "published": "2026-05-31T05:16:24.190", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/OUSL-GROUP-BrinaryBrains/School-Student-Management-System/issues/26"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/819395"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/367423"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/367423/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-640"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1e70e5ad1125b86dca4ee086eb6bb121f17708b6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "School Student Management System", "source": "cna", "vendor": "OUSL-GROUP-BrinaryBrains"}, "product": "school_student_management_system", "vendor": "ousl-group-brinarybrains"}], "created": "2026-05-31T07:30:06.285957+00:00", "updated": "2026-06-02T20:55:44.059389+00:00", "vendors": ["ousl-group-brinarybrains", "ousl-group-brinarybrains$PRODUCT$school_student_management_system"]}