Syllabus-Aligned LMS EUVD-2026-72272

The vulnerability is in manage_subjects.php in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. For reflected XSS, the attacker must persuade a user with an active session to click a crafted URL containing the payload in the msg, title, or content parameters (passive user interaction required per CVSS UI:P). For stored XSS, the attacker must be able to submit a subject record - the CVSS PR:N suggests unauthenticated submission may be possible, but the stored variant's authentication requirement has not been independently verified beyond the PoC. Exploitation is limited entirely to browser-side impact (session hijacking, credential phishing within the LMS, DOM manipulation); no server-side code execution is achievable through this vulnerability alone. The system must be reachable over the network.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores only 2.1 due to low integrity impact and required passive user interaction - an accurate reflection that direct server compromise is not possible. The E:P supplemental metric confirms publicly available exploit code, which materially lowers the bar for abuse and is the most significant escalating factor here. Stored XSS is the more dangerous variant: once a payload is planted, every subsequent visitor is a victim without further attacker involvement. Even a mid-sized municipal IT team in sopot deploying this system for student examination management would face real session-hijacking risk for any authenticated users, including instructors or admins. No KEV listing means no confirmed exploitation at scale. Real-world impact is bounded by the product's extremely limited deployment footprint - this is a SourceCodester demo project, not enterprise software.

An attacker injects a JavaScript payload into the content parameter of manage_subjects.php - either by submitting a crafted subject record (stored XSS) or by sending a victim a malicious URL containing the payload (reflected XSS). A public PoC on GitHub documents both attack paths. When a logged-in user (instructor or admin) loads the affected page, the browser executes the script and the attacker receives the victim's session token, enabling account takeover.