Is there a public PoC exploit available for EUVD-2026-33451?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33451. Prioritise patching immediately. EPSS: 0.0%.

STUDENT-MANAGEMENT-SYSTEM EUVD-2026-33451

Q: What is the CVSS score of EUVD-2026-33451?

EUVD-2026-33451 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10112 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-30 VulDB

GHSA-2hcf-jmx4-h26p

XSS Student Management System

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 30, 2026 - 08:26 vuln.today

CVSS changed

May 30, 2026 - 08:22 NVD

2.4 (LOW) 1.9 (LOW)

DescriptionCVE.org

A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. Affected is an unknown function of the component Dashboard Page. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Cross-site scripting in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 allows a high-privileged authenticated attacker to inject malicious script into the Name argument on the Dashboard Page, which executes in the browser of any user who subsequently views the affected page. The vulnerability requires both elevated privileges and victim interaction, placing real-world impact firmly in the low-to-negligible range despite network reachability. No public exploit identified at time of analysis as actively weaponized (no CISA KEV listing), though publicly available exploit code exists via a GitHub issue disclosure.

Technical ContextAI

STUDENT-MANAGEMENT-SYSTEM is an open-source PHP-based academic records web application maintained at github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): user-supplied input in the Name field on the Dashboard Page is rendered into the HTML response without adequate output encoding or sanitization. The CPE string cpe:2.3:a:sambitraj:student-management-system:*:*:*:*:*:*:*:* with the wildcard version segment indicates the version range is not bounded above in NVD data, though the disclosure references version 1.0 specifically. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N confirms the attack is network-delivered with low complexity, but the impact is strictly limited to low integrity modification with no confidentiality or availability consequence, and no scope change into other components.

RemediationAI

No vendor-released patch has been identified at time of analysis. The project maintainer was notified via a responsible disclosure issue report (github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/3) but had not responded as of the disclosure date. Until a patch is released, administrators should apply output encoding for all user-supplied input rendered in the Dashboard Page - specifically escaping HTML special characters in the Name field before rendering. Deploying a Content Security Policy (CSP) header with a strict script-src directive can meaningfully reduce the impact of any XSS payload that does execute, though it does not eliminate the underlying flaw. Restricting Dashboard Page access to the minimum required set of privileged users limits the attacker population. Because the CVSS vector requires PR:H (high privileges), reducing the number of high-privilege accounts is the single most effective compensating control. Monitor the upstream GitHub repository at github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM for any commits or tagged releases addressing this issue.