Which versions of Student Result Management System are affected by CVE-2025-5727?

CVE-2025-5727 is a low-severity vulnerability in A vulnerability classified as problematic involving cross-site scripting (CVSS 2.4).

Is there a public PoC exploit available for CVE-2025-5727?

Yes, a public proof-of-concept exploit is available for CVE-2025-5727. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5727?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

Student Result Management System CVE-2025-5727

Q: What is the CVSS score of CVE-2025-5727?

CVE-2025-5727 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17090 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-06 cna@vuldb.com

XSS Student Result Management System Razormist

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Requires high privileges and user interaction; low impact on confidentiality and integrity.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.4 (LOW) 1.9 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17090

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

PoC Detected

Jun 10, 2025 - 19:30 vuln.today

Public exploit code

CVE Published

Jun 06, 2025 - 07:15 cve.org

LOW 1.9

CVE Published

Jun 06, 2025 - 07:15 nvd

LOW 2.4

DescriptionCVE.org

A vulnerability classified as problematic has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /script/academic/announcement of the component Announcement Page. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Title field on the Announcement page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in the Announcement page of a PHP-based student management system. The Title argument is not sanitized before storage and display, allowing script injection. The affected product is identified by CPE cpe:2.3:a:razormist:student_result_management_system:1.0.

RemediationAI

No vendor-released patch identified at time of analysis. As a workaround, sanitize the Title input on the Announcement page to prevent HTML/JavaScript injection. Consider disabling the announcement feature if not essential. Note that these mitigations may affect functionality.