ଓଡ଼ିଆ | ENGLISH
ଓଡ଼ିଆ | ENGLISH
T20
T20

Teen Cybersecurity Researcher Exposes Severe Security Flaws in CBSE Digital Evaluation System

National grading operations face heavy scrutiny following revelations of severe engineering mistakes inside digital evaluation software. An independent investigation detailed how flawed script verification allowed complete control over internal grading dashboards.
Published By : Satya Mohapatra | May 27, 2026 10:20 AM
Teen Cybersecurity Researcher Exposes Severe Security Flaws in CBSE Digital Evaluation System

Teenager detects critical vulnerabilities in central evaluation architecture

Digital evaluation systems managed by national school boards require urgent security overhauls after a nineteen-year-old student uncovered systemic vulnerabilities in the On-Screen Marking network. West Bengal student Nisarga Adhikary exposed deep flaws within the platform utilized by examiners to grade board transcripts online. This independent investigation revealed that malicious actors could bypass authentication procedures to intercept teacher logins, manipulate structural data, and alter student transcripts directly.

Security protocols failed due to a hardcoded master password embedded directly inside public-facing scripts. This oversight enabled anyone with basic browser tools to override one-time password verifications and impersonate state evaluators using accessible school codes. The alert follows independent verification requests sent by over four lakh local students who noticed immediate discrepancies, mismatched handwriting samples, and calculation errors when accessing their scanned scripts this month. These compounding technical issues reflect a broader struggle across Eastern regional centers where schools face constant infrastructure hurdles while adopting paperless management structures.

The government agency managing national internet infrastructure received notification regarding this exposure as early as February. Though the response teams acknowledged the filing, the researcher verified that multiple backdoors remained operational during active evaluation periods. The administrative board eventually disabled the public path to the damaged architecture, issuing statements declaring the exposed interface was merely an isolated environment containing dummy data rather than active national metrics.