SourceCodester SRMS EUVD-2026-91626

Exploitation targets the Announcement Module via the 'title' or 'announcement' parameters of script/academic/core/new_announcement.php in Student Result Management System 1.0. As a stored XSS, the attacker must be able to submit/create an announcement record, and the payload only fires when a victim subsequently views the rendered announcement - the CVSS UI:P/UI:R requirement means it cannot execute without a victim loading the affected page. Impact is limited to the integrity of the victim's browser session (script execution in-context); there is no direct confidentiality or availability impact to the server. Limiting factors: required victim interaction (page view), likely need for access to the announcement-posting function, and the niche deployment of this specific application.

This is a genuinely low-priority issue despite being publicly disclosed. The input CVSS 4.0 vector scores only 2.1, reflecting limited impact (VI:L, with VC:N/VA:N) and a requirement for passive user interaction (UI:P). The signals are internally consistent and point to low real-world risk: it is a stored cross-site scripting flaw (CWE-79) in a niche educational application. Exploitation status is 'publicly available exploit code exists' (E:P / POC referenced in the VulDB report), but there is NO CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. Note a conflict worth verifying: VulDB assigns PR:N (unauthenticated), yet the referenced report characterizes this as STORED XSS in an Announcement Module, which typically requires authenticated access to post an announcement - this discrepancy means the true attacker prerequisite may be PR:L rather than PR:N, further reducing practical risk. Overall: a real but minor defect, not a priority outside the specific product's user base.

An attacker with the ability to submit an announcement injects a malicious script payload into the 'title' or 'announcement' field of new_announcement.php, which is stored and later rendered to other users (e.g., students or staff viewing the announcement). When a victim loads the page, the script executes in their browser session, enabling session/cookie theft or UI manipulation. Public proof-of-concept exploit code exists per the VulDB report, lowering the effort required.