Is there a public PoC exploit available for CVE-2026-10228?

Yes, a public proof-of-concept exploit is available for CVE-2026-10228. Prioritise patching immediately. EPSS: 0.0%.

Student Management System CVE-2026-10228

Q: What is the CVSS score of CVE-2026-10228?

CVE-2026-10228 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33561 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-01 VulDB

GHSA-599r-3jch-9p84

PHP XSS Student Management System By Php Raisulislamg4

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 01, 2026 - 08:22 NVD

3.5 (LOW) 2.0 (LOW)

Analysis Generated

Jun 01, 2026 - 07:52 vuln.today

DescriptionCVE.org

A vulnerability was found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. The impacted element is an unknown function of the file admission_form_check.php. The manipulation of the argument Message results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Reflected or stored cross-site scripting (XSS) in raisulislamg4's student_management_system_by_php allows authenticated remote attackers to inject malicious scripts via the Message argument in admission_form_check.php. The vulnerability requires a victim to interact with a crafted link or page, triggering script execution in the context of another user's browser session. A public exploit exists per the GitHub issue report; however, the vendor has not responded to disclosure and no patch has been released.

Technical ContextAI

The affected product is a PHP-based student management application identified by CPE cpe:2.3:a:raisulislamg4:student_management_system_by_php:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input via the Message parameter in admission_form_check.php is rendered in an HTTP response without adequate sanitization or output encoding. PHP applications that directly echo or interpolate request parameters into HTML without htmlspecialchars() or equivalent escaping are the canonical pattern for this class of vulnerability. The CVSS temporal modifier E:P confirms exploit code exists in proof-of-concept form, and RC:R (Reasonable confidence) indicates the vulnerability is credibly reported but not yet independently fully verified by a major authority such as NVD.

RemediationAI

No vendor-released patch identified at time of analysis - the project maintainer has not responded to the coordinated disclosure. Organizations running this software should manually patch admission_form_check.php by applying output encoding to the Message parameter using PHP's htmlspecialchars() with ENT_QUOTES before rendering the value in any HTML context; this eliminates the injection point without functional side effects. As a compensating control, deploy a Web Application Firewall (WAF) rule to block requests containing common XSS payloads (script tags, javascript: URIs, event handler attributes) targeting the Message parameter - note this is a detection/mitigation layer, not a fix, and can be bypassed by obfuscated payloads. Additionally, restrict access to admission_form_check.php to only authenticated roles that genuinely require it, reducing the exposed surface. Reference the VulDB entry at https://vuldb.com/cve/CVE-2026-10228 and https://vuldb.com/vuln/367507 for updates on vendor response.