STUDENT-MANAGEMENT-SYSTEM EUVD-2026-33451

Exploitation requires the attacker to possess a high-privilege authenticated session within STUDENT-MANAGEMENT-SYSTEM (CVSS PR:H) - unauthenticated or low-privilege users cannot trigger this vulnerability. A second condition, CVSS UI:P, requires that at least one other user load the Dashboard Page containing the injected payload after it has been submitted. The attack is limited to the Dashboard Page's Name argument specifically; other application components are not implicated in this disclosure. Exploitation is further bounded by the application's likely small and controlled user base - this is a niche open-source academic tool, not a widely deployed enterprise platform. No special network position, non-default configuration, or protocol condition is required beyond holding a high-privilege account.

The CVSS 4.0 base score of 1.9 accurately reflects the compound limitations of this vulnerability. PR:H mandates that the attacker already hold high-privilege credentials within the application before exploitation is possible - the attacker has already cleared a significant authentication barrier. UI:P further requires that a separate user interact with the affected page for the payload to execute. Together, these constraints make opportunistic, automated, or unauthenticated exploitation impossible. The impact metrics (VI:L only, all others N) confirm that successful exploitation yields only minor integrity degradation - typical of a stored XSS that modifies page appearance or redirects a victim, rather than achieving account takeover or data exfiltration. No EPSS score was provided in the input data; given the niche, low-traffic nature of this open-source student management project, real-world exploitation probability is expected to be very low. Publicly available exploit code exists (via GitHub issue #3), but no CISA KEV listing exists, meaning no confirmed in-the-wild abuse has been documented. The primary realistic risk scenario is insider-threat-style abuse by a trusted high-privilege user. CVSS and contextual signals are fully consistent here - this is a genuine low-priority issue.

An attacker who already holds a high-privilege account in the application navigates to the Dashboard Page and submits a crafted value in the Name field containing a JavaScript payload. When another authenticated user subsequently loads the Dashboard Page, the injected script executes in their browser session. Publicly available exploit code exists via the GitHub issue disclosure, lowering the skill bar for anyone who already has the required privileged access.