CVE-2025-65136

EUVD-2025-209447 MEDIUM

2026-04-14 mitre

GHSA-w4rq-w543-jw73

PHP XSS N A

6.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:40 vuln.today

CVSS Changed

Apr 14, 2026 - 18:22 NVD

6.1 (MEDIUM)

DescriptionNVD

In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter.

AnalysisAI

Reflected cross-site scripting (XSS) in manikandan580 School-management-system 1.0 allows unauthenticated remote attackers to inject malicious scripts via the pagedes POST parameter in /studentms/admin/contact-us.php, affecting users with browser cookies or session tokens. Publicly available exploit code exists, and the vulnerability impacts confidentiality and integrity with moderate scope. CVSS score of 6.1 reflects the requirement for user interaction to trigger the malicious payload.

Technical ContextAI

The vulnerability is a reflected XSS flaw rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), occurring in a PHP-based school management application. The pagedes POST parameter in the contact-us.php endpoint lacks proper input sanitization or output encoding before being rendered in HTML context. Unlike stored XSS, reflected XSS requires the attacker to deliver a crafted URL or form submission containing the malicious payload; the server echoes the unsanitized input back to the victim's browser, where it executes in the victim's security context. PHP applications commonly mishandle user input validation and context-aware encoding (HTML entity encoding vs. JavaScript escaping vs. URL encoding), creating opportunities for script injection.

RemediationAI

Apply vendor patch or upgrade to a patched version released after CVE-2025-65136 disclosure. Implement input validation to reject or sanitize unexpected characters in the pagedes parameter; use a whitelist of allowed characters if the parameter has a known format. Apply context-appropriate output encoding (HTML entity encoding) to all user-controlled data before rendering in HTML context, using PHP functions such as htmlspecialchars() or htmlentities(). For immediate mitigation, implement a Web Application Firewall (WAF) rule to block POST requests to contact-us.php containing script-like patterns (e.g., <script>, javascript:, onerror=) in the pagedes parameter. Review the full advisory at https://nvd.nist.gov/vuln/detail/CVE-2025-65136 and https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2025-65136/README.md for additional details.

CVE-2025-65136 vulnerability details – vuln.today

Back