EUVD-2025-18845Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as admin
-
DeliveryNavigate to System Settings
-
ExploitInject XSS payload in School Name
-
ExecutionVictim admin views settings
-
PersistPayload executes in victim's browser
-
ImpactSteal session or perform actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access with admin privileges (PR:H) to the System Settings page. The attacker must have the ability to modify the School Name field. User interaction (UI:P) is needed for the victim to view the settings page. No special configuration is required beyond default installation. |
| Impact | CVSS 4.0 base score is 1.9 (Low) with vector AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating high privileges required and user interaction needed. EPSS score is 0.06% (17th percentile), suggesting low exploitation probability. A public exploit exists but is not listed in CISA KEV. The SSVC decision would likely be 'Low' due to high privileges and user interaction. Overall risk is low despite public exploit. |
| Exploit ScenarioDerived | An authenticated admin with access to the System Settings page submits a crafted School Name containing JavaScript payload. When another admin views the settings page, the script executes, potentially stealing session cookies or performing actions on behalf of the victim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the School Name parameter on the System Settings page. A public exploit exists, but the vulnerability requires high privileges and user interaction, limiting real-world impact.
Earlier versions of this analysis (1)
RemediationAI
No official patch has been released by the vendor. As a workaround, sanitize the School Name input field to strip or encode HTML/JavaScript characters. Restrict access to the admin panel to trusted users only. Consider disabling the System Settings page if not needed. Monitor for any vendor updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored cross-site scripting (XSS) issue, classified under CWE-79. The affected component is the System Settings page in the admin panel of the Student Result Management System, a PHP-based web application. The School Name input field is not properly sanitized, allowing injection of malicious scripts that execute in the context of other admin users viewing the settings. The CPE indicates the product version is 1.0.
Know when Student Result Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires admin privileges (PR:H) and user interaction (UI:R); low impact on confidentiality and integrity.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /script/admin/system of the component System Settings Page. The manipulation of the argument School Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2025-6477 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated cri
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated cri
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated cri
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated cri
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from the /srms/change-password.php component
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the em
Critical SQL injection vulnerability in PHPGurukul Student Result Management System version 1.3, exploitable through the
Student Result Management System versions up to 1.0 is affected by improper resource shutdown or release (CVSS 6.5).
CVE-2025-7534 is a critical SQL injection vulnerability in PHPGurukul Student Result Management System 2.0, exploitable
SourceCodester Student Result Management System 1.0 contains improper access controls in the bulk user import functional
Improper access control in SourceCodester Student Result Management System 1.0 allows unauthenticated remote attackers t
SourceCodester Student Result Management System 1.0 stores authentication credentials in cleartext within an HTTP-access
Exploit-DB