What is the CVSS score of CVE-2025-50582?

CVE-2025-50582 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-50582?

Yes, a public proof-of-concept exploit is available for CVE-2025-50582. Prioritise patching immediately. EPSS: 0.2%.

StudentManage CVE-2025-50582

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-18 cve@mitre.org

XSS Studentmanage

4.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

PR:H confirmed by admin-only injection point; S:C reflects XSS crossing into victim browser session; no availability impact applies.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:21 vuln.today

DescriptionCVE.org

StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Course module.

AnalysisAI

Stored cross-site scripting in DayCloud StudentManage v1.0 allows an authenticated administrator to inject malicious JavaScript via the Add A New Course module, which then executes in the browsers of other users who view the affected course content. The CVSS vector (PR:H/UI:R/S:C) confirms this requires admin-level access and victim interaction, with scope change reflecting script execution in a different user's browser context. A public proof-of-concept is available on GitHub, though EPSS sits at 0.22% (13th percentile), and the vulnerability is not listed in CISA KEV, indicating no observed widespread exploitation.

Technical ContextAI

StudentManage is a web-based student management application developed by DayCloud (CPE: cpe:2.3:a:daycloud:studentmanage:1.0), with source hosted at gitee.com/DayCloud/student-manage. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input in the Add A New Course module is insufficiently sanitized or encoded before being rendered as HTML in other users' browsers. The Scope:Changed CVSS metric confirms this is almost certainly a stored XSS variant - the injected payload persists server-side and fires when any user navigates to the affected course view, crossing the security boundary from the admin's session into arbitrary victim sessions.

RemediationAI

No vendor-released patch has been identified at time of analysis. The source repository at https://gitee.com/DayCloud/student-manage should be monitored for commits addressing input sanitization in the course management module. As a specific compensating control, apply output encoding (HTML entity encoding) to all user-supplied fields rendered in course listing and course detail views - this is the primary technical fix and can be applied directly to the source if self-hosted. Implement a Content Security Policy (CSP) header with a restrictive script-src directive to reduce the blast radius of any XSS execution; note that overly restrictive CSP may break legitimate inline scripts and requires testing. Restrict admin account access to trusted personnel and enforce multi-factor authentication on admin sessions to raise the cost of the required PR:H prerequisite. If the application is not actively in use, consider taking it offline until a fix is confirmed.