Simple Student Information System CVE-2026-105809

Exploitation requires that the application's /register.php registration endpoint be publicly reachable and that the Profile Field Handler render attacker-supplied firstname/lastname values without output encoding - the default behavior described. The key LIMITING factor is user interaction (UI:P): a victim must view the page containing the injected payload for the script to execute; no attacker authentication is required (PR:N). Impact is confined to client-side script execution in the victim's browser context - there is no server-side code execution, no confidentiality breach of stored data, and no availability impact.

This is a genuinely low-to-moderate priority issue despite its remote attack vector. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 5.3 and correctly reflects the nature of CWE-79 cross-site scripting: network-reachable and unauthenticated (PR:N) to inject, but requiring victim user interaction (UI:P, passive) to execute, with only limited integrity impact (VI:L) and no confidentiality or availability impact. Exploit code is publicly available (via a GitHub issue referenced by VulDB), which raises opportunistic risk, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals and should not be conflated. The affected product, SourceCodester Simple Student Information System 1.0, is a free demonstration/tutorial PHP application with negligible production footprint, which dramatically lowers real-world risk regardless of the CVSS number. In short: a high-visibility-but-low-real-risk issue - a real but minor XSS in a rarely-deployed hobby application, with public POC but no confirmed exploitation.

An attacker submits the registration form at /register.php with a crafted JavaScript payload in the firstname or lastname field, which the Profile Field Handler stores or reflects without sanitization. When a victim (such as an administrator reviewing registrations) views the affected profile field, the script executes in their browser session. A public proof-of-concept exists, so exploitation requires little attacker skill, though it still depends on a victim viewing the malicious content (UI:P).