EUVD-2026-26141Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible reflected XSS with no auth required, but victim must click crafted link; scope changes to browser; no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim's browsers via the unsanitized type parameter in register.php.
AnalysisAI
Reflected XSS in School Management System (by mahmoudai1) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the type parameter of register.php, which is reflected without sanitization. The attack requires social engineering to deliver a crafted URL to a target (UI:R per CVSS), and a proof-of-concept exploit is publicly available per SSVC classification and a dedicated CVE PoC repository. EPSS is extremely low (0.01%, 3rd percentile), indicating negligible opportunistic exploitation observed in the wild despite the POC's existence, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
School Management System is a PHP web application published on GitHub by the developer mahmoudai1. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS in register.php, where user-supplied input via the type GET/POST parameter is echoed back into the HTTP response without HTML encoding or sanitization. Because the payload is reflected rather than stored, exploitation requires the victim to follow a crafted URL. The CVSS scope is Changed (S:C), correctly capturing that the injected script executes in the victim's browser context - a different security domain from the vulnerable server. No CPE string was available from the EUVD data (listed as 'n/a'); affected version information is therefore limited to the GitHub repository's main branch state at time of disclosure.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis; the project appears to be an individual open-source repository without a formal release cycle. The immediate fix is to apply output encoding to the type parameter in register.php before it is rendered into any HTML context - specifically, PHP's htmlspecialchars() with ENT_QUOTES and UTF-8 encoding. Additionally, all user-supplied input in the application should be audited for similar unencoded reflections. As a compensating control, deployers can configure a Web Application Firewall (WAF) rule to detect and block XSS payloads in the type parameter, though this introduces bypass risk and is not a substitute for source-level remediation. Content Security Policy (CSP) headers - particularly script-src directives that prohibit inline scripts - would significantly limit exploitability even if the reflection remains. The upstream repository is at https://github.com/mahmoudai1/school-management-system and the VulDB advisory is at https://vuldb.com/vuln/360089.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today