StudentManage
CVE-2025-50583
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Admin credentials required (PR:H) to inject payload; victim must load the page (UI:R); scope changes as script executes in victim browser context; no availability impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Student module.
AnalysisAI
Stored XSS in DayCloud's StudentManage v1.0 allows an authenticated administrative user to inject malicious JavaScript via the 'Add A New Student' module, which executes in the browser of any user who subsequently views the affected record. The Scope:Changed metric confirms the injected script runs in a different security context (the victim's browser session), enabling session hijacking or credential theft. No active exploitation is confirmed via CISA KEV, though a public proof-of-concept exists on GitHub; EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Technical ContextAI
The affected product is DayCloud StudentManage version 1.0, uniquely identified by CPE cpe:2.3:a:daycloud:studentmanage:1.0, with the source repository hosted at https://gitee.com/DayCloud/student-manage. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) identifies the root cause as a failure to sanitize or HTML-encode attacker-controlled input before rendering it in the browser DOM. Specifically, the 'Add A New Student' form module does not escape HTML-special characters in submitted fields, enabling injection of arbitrary script tags or event-handler attributes that persist in the application's data store and execute when a victim views the student record.
RemediationAI
No vendor-released patch has been identified at the time of analysis. The primary remediation is to apply server-side output encoding to all user-supplied fields in the 'Add A New Student' module, escaping HTML-special characters before rendering them in the browser, as prescribed by OWASP for CWE-79. As a compensating control, deploying a strict Content Security Policy (CSP) header that disallows inline script execution will significantly reduce the exploitability of any residual XSS vectors; note that CSP may break legitimate inline scripts if the application relies on them. Restricting administrative access to trusted internal IP ranges limits the pool of users who could inject a payload. The public exploit reference is available at https://github.com/SimonKang949/Vulnerabilities/issues/4 and can be used to validate any applied fix.
More in Studentmanage
View allSQL injection in DayCloud StudentManage v1.0 lets an authenticated attacker inject arbitrary SQL through the /admin/admi
Cross-site request forgery in StudentManage v1.0 (DayCloud) allows a remote attacker to perform unauthorized state-chang
Stored cross-site scripting in DayCloud StudentManage v1.0 allows an authenticated administrator to inject malicious Jav
Stored cross-site scripting in DayCloud's StudentManage v1.0 allows authenticated administrators to inject malicious Jav
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today