Is there a public PoC exploit available for CVE-2026-9485?

Yes, a public proof-of-concept exploit is available for CVE-2026-9485. Prioritise patching immediately. EPSS: 0.0%.

Student Grades Management System CVE-2026-9485

Q: What is the CVSS score of CVE-2026-9485?

CVE-2026-9485 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31721 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-fh69-mhwv-2f68

PHP XSS Student Grades Management System

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:30 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

3.5 (LOW) 2.0 (LOW)

DescriptionCVE.org

A vulnerability was identified in SourceCodester Student Grades Management System 1.0. Affected by this issue is some unknown functionality of the file students.php. The manipulation of the argument Remarks leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

Cross-site scripting in SourceCodester Student Grades Management System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the unvalidated 'Remarks' parameter in students.php, executing arbitrary scripts in the context of a victim's browser session upon passive viewing. A public proof-of-concept exists on GitHub; however, this CVE is not listed in the CISA KEV catalog and the EPSS score of 0.03% (9th percentile) reflects very low real-world exploitation probability. SSVC assessment corroborates this with 'Exploitation: none' and 'Automatable: no,' consistent with the required user-interaction constraint.

Technical ContextAI

The vulnerability resides in students.php, a PHP script within SourceCodester Student Grades Management System 1.0 (CPE: cpe:2.3:a:sourcecodester:student_grades_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), indicating that the 'Remarks' field value is echoed back to the browser without adequate output encoding or HTML sanitization. In PHP applications, this typically means the absence of htmlspecialchars() or equivalent escaping before rendering user-supplied data, allowing attacker-controlled text to be interpreted as executable HTML or JavaScript by victims' browsers. The product is a free, open-source PHP academic management tool distributed by SourceCodester.

RemediationAI

No vendor-released patch has been identified at the time of analysis. Organizations running this application should apply a code-level fix directly in students.php by encoding the 'Remarks' output using PHP's htmlspecialchars() with the ENT_QUOTES flag before rendering to the browser - this eliminates the XSS sink with no functional side effects on legitimate content. As a compensating control, a Web Application Firewall (WAF) rule targeting common XSS payload patterns on the Remarks parameter can reduce exploitation risk, though WAF rules may generate false positives on legitimate inputs containing angle brackets or script-like character sequences, requiring tuning. Access to students.php should be restricted to the minimum necessary user roles, reducing the pool of accounts capable of staging the injected payload given the PR:L prerequisite. Refer to the VulDB advisory at https://vuldb.com/vuln/365466 and the proof-of-concept report at https://github.com/Jack-MRJ/Student-Grades-Management-System-Vulnerability-Report for additional technical detail to inform manual patching.