CVE-2026-9582
MEDIUM 5.3 PoC AVAILABLEA security flaw has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects an unknown function. Performing a manipulation results in cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
EXPLOIT AVAILABLE
Public exploit or PoC code exists. Modeled probability is still low, but the barrier to attack is reduced — watch closely.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 5th percentile
○ In CISA KEV
● Public exploit / PoC
Impact if exploited
5.3CVSS 4.0 · MEDIUM
- ConfidentialityNone
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: Succeeds with passive user activity
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
- PoC https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9582-Cross-Site-Request-Forgery/Advisory.md
- PoC https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9582-Cross-Site-Request-Forgery/poc.html
Listed for defensive triage and patch prioritization.
Weakness (CWE)
- CWE-352: Cross-site request forgery (CSRF)
- CWE-862: Missing authorization
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P