CET Grading System CVE-2026-7401

The registration endpoint /index.php?action=register must be publicly accessible without authentication - the CVSS vector (PR:N) and exploit title ('Unauthenticated') confirm no login is required to inject the payload. The vulnerable parameters are student_id, full_name, section, and username in the registration form. Successful impact requires an administrator (or other authenticated user) to subsequently view the stored registration data in the admin dashboard - this is the UI:P (passive interaction) condition in the CVSS 4.0 vector. Exploitation is limited to deployments of version 1.0 of this specific PHP application; no other products are affected. The attack is not automatable per SSVC, meaning the attacker cannot programmatically force admin viewing.

Despite a CVSS 4.0 base score of 2.1, the actual risk profile is nuanced. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms network-reachable, unauthenticated exploitation requiring only passive admin interaction, which is a realistic condition in any production deployment of this system. SSVC assesses Technical Impact as 'partial' and Automatable as 'no', consistent with stored XSS that requires an admin to view the injected data. EPSS at 0.03% (9th percentile) reflects the obscurity of the product rather than low exploitability - the attack itself is trivial once a target runs this software. The public POC hosted on GitHub lowers the attacker skill bar significantly. KEV is not listed, indicating no confirmed widespread exploitation. The primary risk is admin session hijacking or grade/data manipulation in any institution running this specific Sourcecodester application. The very low CVSS score should not be interpreted as low severity in context: stored XSS targeting an admin dashboard in an academic grading platform has real integrity implications (grade tampering).

An unauthenticated attacker submits a student registration form at /index.php?action=register, injecting a JavaScript payload (e.g., a cookie-stealing script) into the full_name or username field. The payload is stored server-side without sanitization. When an administrator logs into the admin dashboard and browses the student registration list, the stored script executes in the admin's browser session, potentially exfiltrating the admin's session cookie or performing unauthorized grade modifications on behalf of the admin. A public proof-of-concept demonstrating this exact flow is available at the referenced GitHub repository.