EUVD-2025-18843Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as admin
-
DeliveryNavigate to Manage Students
-
ExploitInject XSS payload in student name
-
ExecutionVictim admin views student list
-
PersistScript executes in victim's browser
-
ImpactSteal session or perform actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires admin-level authentication (PR:H) and user interaction (UI:P) - the victim must click on a crafted link or visit the Manage Students page. The attack is remote but only possible if the attacker has admin credentials. |
| Impact | CVSS 4.0 base score is 1.9 (Low) with vector AV:N/AC:L/AT:N/PR:H/UI:P, indicating high privileges required and user interaction needed. EPSS score is 0.04% (low probability). No KEV listing. Public POC exists but exploitation is not trivial due to privilege requirements. Overall risk is low. |
| Exploit ScenarioDerived | An authenticated admin with high privileges visits the Manage Students page and injects a malicious script into a student name field. When another admin views the student list, the script executes, potentially stealing session cookies or performing actions on behalf of the victim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Manage Students module. A public exploit exists, but exploitation requires high privileges and user interaction, limiting real-world risk.
Earlier versions of this analysis (1)
RemediationAI
No vendor patch identified. As a workaround, sanitize all input fields in the Manage Students module, especially the student name and other text fields. Restrict admin panel access to trusted users only. Consider disabling the Manage Students feature if not needed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored XSS (CWE-79) in the Manage Students module of a PHP-based student management system. The CPE indicates version 1.0 of the product by razormist. The root cause is improper sanitization of user input in the /script/admin/manage_students endpoint, allowing script injection.
Know when Student Result Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
PR:H due to admin access; UI:R required; low impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /script/admin/manage_students of the component Manage Students Module. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2025-6475 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated cri
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated cri
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated cri
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated cri
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from the /srms/change-password.php component
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the em
Critical SQL injection vulnerability in PHPGurukul Student Result Management System version 1.3, exploitable through the
Student Result Management System versions up to 1.0 is affected by improper resource shutdown or release (CVSS 6.5).
CVE-2025-7534 is a critical SQL injection vulnerability in PHPGurukul Student Result Management System 2.0, exploitable
SourceCodester Student Result Management System 1.0 contains improper access controls in the bulk user import functional
Improper access control in SourceCodester Student Result Management System 1.0 allows unauthenticated remote attackers t
SourceCodester Student Result Management System 1.0 stores authentication credentials in cleartext within an HTTP-access
Exploit-DB