Student Management System EUVD-2026-86501

Exploitation requires an attacker to deliver a crafted request to admin/fun/addLog.php with a malicious script in the reason or detail parameter AND requires a victim to interact (open the attacker-supplied link/view the reflected output), per UI:P/UI:R. It is limited by the reflected (non-persistent) nature of the flaw, the need for user interaction, the very small real-world deployment of this hobby project, and the likelihood that the admin/ path is an operator-facing log function so the most valuable target is an authenticated administrator rather than an anonymous public user. Impact is bounded to integrity (VI:L) with no direct confidentiality or availability loss.

This is a reflected cross-site scripting flaw (CWE-79) rated by VulDB at CVSS 4.0 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N - network-reachable, low complexity, no privileges, but requiring user interaction and yielding only limited integrity impact (no confidentiality or availability loss). Signals are consistent but modest: E:P (Proof-of-Concept) in the 4.0 vector matches the disclosed public exploit in GitHub issue #11, so publicly available exploit code exists. There is no EPSS score and no CISA KEV listing, so there is no evidence of active or automated exploitation. The realistic risk is LOW-to-MODERATE and heavily bounded by product prevalence: ningzichun/student-management-system is an obscure single-author GitHub PHP project with negligible production footprint, and the file path (admin/fun/addLog.php) suggests an administrative log function, meaning practical exploitation likely targets an authenticated admin/operator via a crafted link rather than anonymous public users. Vendor has been notified via issue report but is non-responsive with no fix. Net: a genuine but low-priority XSS in a rarely-deployed hobby application, not a widespread threat.

An attacker crafts a URL or form input to admin/fun/addLog.php with a malicious payload in the reason or detail parameter, which the page echoes back unsanitized. When a logged-in administrator or user views the reflected content (following an attacker-supplied link), the script executes in their browser session, enabling session/cookie theft or actions in the admin context. A public proof-of-concept exists (GitHub issue #11), and the CVSS UI:P/UI:R metric confirms victim interaction is required.