Student Information System EUVD-2026-93224

Exploitation targets the search feature: an attacker must supply a malicious string to the 'searchbox' argument handled by the clean function in searchresults.php, which is reflected into the rendered results page without proper output encoding. Limiting factors per the CVSS 4.0 vector: the attacker needs low-level authentication (PR:L) to reach the search page, and successful exploitation requires passive victim interaction (UI:P) - i.e., a logged-in user must view the attacker-influenced results page. It is a reflected XSS, so no stored/persistent state is implied; impact is confined to integrity within the victim's browser context (VC:N/VI:L/VA:N). This is not remote unauthenticated exploitation against a default configuration.

Signals are consistent and point to a genuinely LOW-to-MODERATE priority issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) yields a modest 5.1 (Medium): it is network-reachable with low complexity, but requires low-level authentication (PR:L) AND passive user interaction (UI:P), and the technical impact is limited to a low integrity hit (VI:L) with no confidentiality or availability impact - typical of reflected cross-site scripting (CWE-79). Exploitation maturity is E:P (proof-of-concept), matching the POC=YES signal: publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The sole reporting source is VulDB (a crowd-sourced database), with no independent vendor advisory. No signals conflict; rather, several are simply absent (EPSS, KEV). Net: a real but low-severity reflected XSS in a niche application - fix in routine patching, not emergency response.

An authenticated low-privileged user (or an attacker who lures such a user) submits a crafted value in the 'searchbox' parameter of searchresults.php, which the clean function fails to sanitize, so the payload is reflected into the results page and executes in the victim's browser. A public proof-of-concept exists (github.com/wsx138/cve/issues/6), lowering the effort to reproduce. Because exploitation needs both authentication (PR:L) and victim interaction (UI:P), it is most plausible in a targeted phishing-style lure rather than mass exploitation.