CVE-2026-2983 is a high severity flaw (CVSS 7.3) in SourceCodester Student Result Management System 1.0. The bulk import script in the admin area has improper access controls, and the File argument can be manipulated remotely. The public report linked from the record describes it as unauthenticated bulk account injection through a file upload. The exploit is public.
What's affected
The NVD record lists SourceCodester Student Result Management System version 1.0. The NVD record does not name a fixed version, so assume every copy you run is exposed until the maintainer says otherwise. The public disclosure and the record are the only sources for this issue.
How to check if you're exposed
Find out whether SourceCodester Student Result Management System 1.0 runs anywhere in your environment, including test servers and old demos. Search the web root for admin/core/import_users.php and review the user list for recently added accounts.
Then check who can reach it. A copy that is open to the internet is the case that matters most, so review the web server, reverse proxy and firewall rules for that host.
What to do now
- Remove SourceCodester Student Result Management System 1.0 from any internet-facing host, or restrict it to a trusted network or VPN.
- Check the project page and the maintainer's contact channels for a fix, and apply it if one has appeared since this was written.
- Block
/admin/core/import_users.phpat the proxy, or require authentication in front of it. - Review the user table for accounts you did not create, and disable any you cannot explain.
- If you maintain the code, require an authenticated admin session and validate uploaded files on the server.
- Keep a list of small third party applications like this one, so a new advisory can be matched against it quickly. The Gold page for this CVE has the latest data: https://gold.safeguard.sh/vulnerability/CVE-2026-2983
Why it matters
The record files this under CWE-266 and CWE-284. The record files this under CWE-266 and CWE-284, which cover incorrect privilege assignment and improper access control. An admin function was reachable by someone who should not have been able to use it. The public report goes further and describes uploads that create accounts. Admin pages need a server side check on every request, not just a hidden link in the interface.
The NVD description says the exploit is public, so anyone can read how the weakness works. A public write-up and no vendor fix is a poor mix for a system that holds real data, which is why exposure control is the main defence here. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog.
Quick check
Who is at risk?
Any install of version 1.0 that is reachable by people you do not trust, such as a school portal on the open internet.
Is there a fix?
The record names none.
Sources
Last reviewed: 19 October 2026.
