EUVD-2026-26282Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS fires in admin browser (scope change S:C); unauthenticated registration PR:N; admin must view data UI:R; integrity and confidentiality both Low via session context.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=register of the component Registration. The manipulation of the argument student_id/full_name/section/username results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.
AnalysisAI
Stored cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows unauthenticated remote attackers to inject persistent malicious scripts via the student registration endpoint, which subsequently execute in the context of authenticated users - most critically, administrators - who view the submitted registration data. The exploit title in the public GitHub repository explicitly identifies the admin dashboard as the execution context, meaning a low-privilege registration action can target privileged session holders. No public exploitation confirmed in CISA KEV, but a proof-of-concept exploit is publicly available.
Technical ContextAI
The affected component is the PHP-based student registration handler at /index.php?action=register within the CET Automated Grading System with AI Predictive Analytics 1.0, identified by CPE cpe:2.3:a:sourcecodester:cet_automated_grading_system_with_ai_predictive_analytics:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored/persistent variant: user-supplied input in the student_id, full_name, section, and username fields is not sanitized before being saved and later rendered in the admin dashboard. Because the payload persists server-side and fires when a privileged user views the registration records, this is a stored (Type II) XSS rather than a reflected variant, which increases impact relative to the CVSS 4.0 base score of 2.1.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the product is a Sourcecodester community/educational PHP application with no formal patch advisory linked in the available references. The primary remediation is to apply output encoding and input sanitization to the student_id, full_name, section, and username fields in the registration handler before storing or rendering them; specifically, HTML-encode all user-supplied values on output using htmlspecialchars() or equivalent PHP functions. As a compensating control, organizations should restrict access to the admin dashboard to trusted network segments or require VPN, reducing the attack surface for any XSS payload that fires in the admin context. Disabling open self-registration (if operationally feasible) eliminates the unauthenticated injection vector entirely. Implementing a Content Security Policy (CSP) header would limit the damage of any XSS execution by blocking inline script execution; however, this depends on application compatibility. Monitor the VulDB advisory at https://vuldb.com/vuln/360133 for any upstream patch.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today