EUVD-2026-43214
GHSA-5g8r-54fv-r8xc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible XSS requiring victim interaction; scope changes to browser context enabling session theft, so PR:N, UI:R, S:C, C:L/I:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. This vulnerability affects unknown code of the file dashboard/studentConductManager.php. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in igweze Wizgrade's dashboard/studentConductManager.php allows remote, unauthenticated attackers to inject and execute malicious scripts in a victim's browser upon interaction with a crafted request. The vulnerability was publicly disclosed with exploit code available (CVSS 4.0 E:P), and the vendor did not respond to pre-disclosure contact, leaving no official patch or remediation guidance. No active exploitation has been confirmed via CISA KEV, though the public exploit raises the risk of opportunistic targeting of school or academic institutions using this PHP-based student management system.
Technical ContextAI
Wizgrade is a PHP-based student management and grading application developed by igweze, identified in CPE as cpe:2.3:a:igweze:wizgrade:*:*:*:*:*:*:*:*. The vulnerability resides in dashboard/studentConductManager.php, a file likely responsible for rendering or managing student conduct records, suggesting user-controlled input is reflected or stored without adequate sanitization or output encoding. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), meaning the application fails to escape or neutralize attacker-controlled input before embedding it in an HTML page served to other users. The exact vulnerable parameter is not disclosed in the report ('unknown code'), which limits precise root-cause pinpointing without source code review. The product uses a rolling release model, meaning it has no formal versioned releases.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to pre-disclosure contact, and no fixed commit or release has been confirmed. Administrators should immediately apply input validation and output encoding to all user-controlled parameters in dashboard/studentConductManager.php, specifically escaping output with htmlspecialchars() or equivalent PHP functions before rendering in HTML context. Deploying a Web Application Firewall (WAF) with XSS filtering rules - such as ModSecurity with the OWASP Core Rule Set - can reduce exploitation risk but should not be treated as a permanent fix, as WAF bypasses are common. Implementing a strict Content Security Policy (CSP) header that blocks inline script execution can limit the damage of a successful XSS, though it requires careful tuning to avoid breaking application functionality. Organizations should monitor the VulDB entry at https://vuldb.com/vuln/377799 and the official repository for any patch commits. If Wizgrade is non-essential or replaceable, evaluating alternative supported software is advisable given the lack of vendor response.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today