EUVD-2026-43215
GHSA-68wj-g9jx-fg7j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege account required (PR:L); victim must trigger payload (UI:R); changed scope reflects script execution in victim browser, enabling session theft (C:L) and page content manipulation (I:L).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument export_date results in cross site scripting. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in Akpali9 Attendance-Management-System allows a remote, low-privileged attacker to inject malicious JavaScript via the export_date parameter in absent.php, executing in the browser context of any victim user who interacts with attacker-crafted content. All versions up to commit 70b91fe38f4195b701a45f0edcd4f42d5f64aeee are affected; the project's rolling release model means no discrete patched version exists, and the vendor did not respond to disclosure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
The affected application is a PHP-based attendance management system (CPE: cpe:2.3:a:akpali9:attendance-management-system:*:*:*:*:*:*:*:*) with the vulnerability rooted in absent.php, which handles export functionality. The export_date parameter is rendered in the HTTP response without adequate sanitization or output encoding - the classic pattern underlying CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting). In PHP applications this typically manifests as user-controlled input passed directly to an echo or print statement without htmlspecialchars() or equivalent encoding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the attack surface is a standard network-accessible web endpoint requiring no special protocol conditions.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to pre-disclosure contact. The most direct remediation is a code-level fix: apply htmlspecialchars() with ENT_QUOTES encoding to the export_date parameter before it is reflected into any HTML output in absent.php - this carries no functional side effects when implemented correctly. Organizations unable to modify application code should deploy a WAF rule blocking common XSS payloads in the export_date request parameter; note that WAF rules for XSS can be bypassed by sufficiently obfuscated payloads and should not be considered a permanent fix. Restricting network access to the absent.php endpoint to trusted internal IP ranges limits exposure at the network layer without touching application logic. As a final fallback, disabling the export feature entirely removes the attack surface at the cost of export functionality. VulDB advisory: https://vuldb.com/vuln/377800.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today