EUVD-2026-19400
GHSA-wx99-4rxc-gxhv
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.3 (CVSS:4.0 scale) with network-accessible attack vector, low complexity, and no privilege requirements indicates moderate risk. The CVSS vector confirms unauthenticated remote access (PR:N) but requires user interaction (UI:P-likely clicking a malicious link), limiting attack automation. EPSS score not provided in input data. The reflected XSS impact is integrity-only (VI:L) with no confidentiality or availability impact. Public exploit code availability (E:P in vector) elevates practical risk despite moderate CVSS score. Absence of vendor response and lack of version-based patching suggest prolonged exposure window; however, the UI requirement and integrity-only impact position this as lower-severity than high-CVSS XSS flaws that enable session hijacking or credential theft. Real-world priority depends on deployment scope and whether the application handles sensitive student data. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing XSS payload in the batch parameter (e.g., /admin/class%20schedule/delete_batch.php?batch=<script>alert('XSS')</script>) and sends it to a logged-in teacher or administrator. When the victim clicks the link or is redirected to it via email/phishing, the JavaScript executes in their browser session, potentially stealing session cookies, redirecting to a credential harvesting page, or modifying student records. Publicly available exploit code on GitHub simplifies attack delivery and lowers the technical barrier for opportunistic attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows unauthenticated remote attackers to inject malicious scripts via the batch parameter in the /admin/class%20schedule/delete_batch.php endpoint, compromised by improper input validation. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f and has publicly available exploit code disclosed on GitHub; the vendor has not responded to early notification.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was notified early through a GitHub issue report (https://github.com/Cyber-III/Student-Management-System/issues/242) but has not responded with a fix. Administrators should implement input validation and output encoding on the batch parameter in delete_batch.php, specifically using PHP htmlspecialchars() or equivalent functions to prevent script injection. Consider implementing Content-Security-Policy (CSP) headers as a defense-in-depth measure. Monitor the GitHub repository (https://github.com/Cyber-III/Student-Management-System/) for any future patches or security updates from the maintainers. If no patch is forthcoming, evaluate alternative student management systems with active security maintenance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a reflected cross-site scripting (CWE-79) flaw in a PHP-based student management system. The Class Schedule Deletion Endpoint fails to properly sanitize or validate the batch parameter before rendering it in the HTTP response, allowing attackers to inject arbitrary HTML and JavaScript. The vulnerable file /admin/class%20schedule/delete_batch.php processes user-supplied input without adequate output encoding or input filtering, a common PHP web application security gap. The product uses commit hashes rather than semantic versioning, complicating patch tracking and making it difficult for administrators to identify affected versions.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Impacted is an unknown function of the file /admin/class%20schedule/delete_batch.php of the component Class Schedule Deletion Endpoint. Executing a manipulation of the argument batch can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB