Is there a public PoC exploit available for CVE-2026-9471?

Yes, a public proof-of-concept exploit is available for CVE-2026-9471. Prioritise patching immediately. EPSS: 0.0%.

StudentManagementSystem CVE-2026-9471

Q: What is the CVSS score of CVE-2026-9471?

CVE-2026-9471 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31703 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-4gg4-mpgv-4v2q

PHP XSS Studentmanagementsystem

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:18 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

3.5 (LOW) 2.0 (LOW)

DescriptionCVE.org

A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file /student.php. Performing a manipulation of the argument FIRST_NAME results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Cross-site scripting in yashpokharna2555's StudentManagementSystem (PHP) allows authenticated remote attackers to inject malicious client-side scripts via the FIRST_NAME parameter in /student.php, executing in victim browsers upon record viewing. The CVSS 4.0 score of 2.0 (Low) reflects the requirement for prior authentication (PR:L) and user interaction (UI:P), significantly constraining real-world impact. Publicly available exploit code exists via a GitHub issue report; no vendor patch has been issued and the maintainer has not responded to the disclosure.

Technical ContextAI

StudentManagementSystem is a PHP-based open-source academic records application tracked under CPE cpe:2.3:a:yashpokharna2555:studentmanagementsystem:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input in the FIRST_NAME form field is rendered back into the HTML response without adequate encoding or sanitization. The /student.php endpoint accepts and stores or reflects this value, which is subsequently displayed in the application's UI. Because no server-side output encoding (e.g., htmlspecialchars in PHP) is applied before rendering the parameter, an attacker-controlled string containing JavaScript tags is interpreted and executed by the victim's browser rather than displayed as inert text.

RemediationAI

No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the responsible disclosure filed at https://github.com/yashpokharna2555/StudentManagementSystem/issues/4. Operators running this application should immediately apply manual input sanitization by wrapping all user-supplied values rendered in HTML with PHP's htmlspecialchars() or equivalent output encoding before display - this directly eliminates the CWE-79 root cause. As a compensating control, deploying a Web Application Firewall (WAF) rule set targeting XSS payloads (e.g., OWASP Core Rule Set) can reduce exploitation likelihood, though WAF bypass techniques exist and this should not be considered a full remediation. Restricting access to /student.php to trusted internal networks or authenticated institutional users reduces the attacker pool. If the student name entry or editing feature is non-essential in the current deployment, temporarily disabling it eliminates the attack surface entirely. Monitor the upstream repository at https://github.com/yashpokharna2555/StudentManagementSystem/ for any commits addressing input sanitization.