Student Grades Management System CVE-2025-11485

Vendor-released patch status not confirmed from available data - contact SourceCodester at https://www.sourcecodester.com/ to request a patched version. Immediate workarounds include: (1) Implement strict input validation on first_name and last_name fields by whitelisting alphanumeric characters and common name separators (hyphens, apostrophes) and rejecting any HTML/JavaScript syntax; (2) Apply HTML entity encoding (htmlspecialchars() in PHP with ENT_QUOTES flag) to all user-controlled data when rendering the Manage Users page; (3) Deploy a Content Security Policy (CSP) header prohibiting inline script execution (script-src 'self'; style-src 'self'); (4) Restrict access to /admin.php via network-level controls (IP whitelisting, VPN requirement) to reduce the number of administrator accounts with access; (5) Monitor admin page access logs for suspicious first_name/last_name patterns containing script tags or event handlers. Note that input validation alone is insufficient - output encoding is mandatory for XSS prevention. If the application allows direct HTML/script input by design, disable that functionality for user name fields.