EUVD-2026-25979Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability was determined in code-projects Coaching Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /cims/modules/student/complaint.php of the component Complaint Form Page. This manipulation of the argument Complaint causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Stored cross-site scripting (XSS) in code-projects Coaching Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the Complaint parameter in the complaint form page (/cims/modules/student/complaint.php), affecting users who view injected content. CVSS 5.1 reflects low confidentiality impact and limited integrity impact requiring user interaction; publicly available exploit code exists, confirming practical exploitability.
Technical ContextAI
The vulnerability resides in the Complaint Form Page component (complaint.php) within the student module of a PHP-based educational management system. The root cause is improper input validation and output encoding on user-supplied Complaint form data (CWE-79: Improper Neutralization of Input During Web Page Generation). The application fails to sanitize or escape the Complaint parameter before rendering it in subsequent pages, enabling attackers to embed arbitrary HTML and JavaScript that executes in the browser context of other authenticated users. The attack vector is network-based but requires prior authentication (PR:L) and user interaction (UI:P), meaning a victim must navigate to or be socially engineered to visit a page containing the attacker's payload.
RemediationAI
Immediate action: disable or restrict access to the complaint form functionality at /cims/modules/student/complaint.php until a patched version is released by code-projects. If the application is critical to operations, implement input validation on the server side by sanitizing all Complaint form input using a whitelist approach (alphanumeric and safe punctuation only) or HTML entity encoding before storage. On output, ensure all user-supplied data rendered in HTML context is properly escaped using context-aware encoding (e.g., htmlspecialchars() in PHP with ENT_QUOTES flag). Apply web application firewall (WAF) rules to block payloads containing script tags, event handlers, and encoded XSS patterns in POST/GET requests to complaint.php. Educate users not to visit complaint view pages from untrusted sources or social engineering messages. Monitor application logs for suspicious complaint submissions containing script tags or event handlers. Contact code-projects.org for patch availability and release timeline; if unpatched, consider isolating the system to a trusted internal network only.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today