Cyber Iii
Monthly
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows unauthenticated remote attackers to inject malicious scripts via the batch parameter in the /admin/class%20schedule/delete_batch.php endpoint, compromised by improper input validation. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f and has publicly available exploit code disclosed on GitHub; the vendor has not responded to early notification.
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows high-privileged authenticated attackers to inject malicious scripts via the $_SERVER['PHP_SELF'] parameter in the /admin/Add%20notice/add%20notice.php endpoint. The vulnerability requires user interaction (UI:P) to trigger and is confirmed by publicly available exploit code, though real-world risk is mitigated by high privilege requirements (PR:H) and limited technical impact (integrity only). The product uses rolling releases with no versioning, and the vendor has not responded to early disclosure.
Stored cross-site scripting (XSS) in Cyber-III Student-Management-System via manipulation of the $_SERVER['PHP_SELF'] variable in the batch-notice.php admin file allows authenticated attackers with high privileges to inject malicious scripts. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f, exploitable remotely with user interaction, and publicly available exploit code exists. CVSS score of 4.8 reflects moderate risk constrained by authentication and interaction requirements, though the integrity impact and active public disclosure elevate operational concern.
Reflected cross-site scripting in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows high-privilege authenticated attackers to inject malicious scripts via the $_SERVER['PHP_SELF'] parameter in the admin notice endpoint (/admin/Add%20notice/notice.php). Publicly available exploit code exists, and the vulnerability requires user interaction (UI) to trigger, limiting practical impact despite remote accessibility.
Improper authorization in Cyber-III Student-Management-System allows unauthenticated remote attackers to bypass authentication controls via crafted HTTP POST requests to /viva/update.php. The vulnerability (CWE-285) enables unauthorized modification of student records by manipulating the 'Name' parameter. Publicly available exploit code exists (GitHub issue #236), and the project maintainer has not responded to responsible disclosure attempts. EPSS data not provided, but CVSS 7.3 with PR:N indicates significant risk for internet-facing deployments.
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows unauthenticated remote attackers to inject malicious scripts via the batch parameter in the /admin/class%20schedule/delete_batch.php endpoint, compromised by improper input validation. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f and has publicly available exploit code disclosed on GitHub; the vendor has not responded to early notification.
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows high-privileged authenticated attackers to inject malicious scripts via the $_SERVER['PHP_SELF'] parameter in the /admin/Add%20notice/add%20notice.php endpoint. The vulnerability requires user interaction (UI:P) to trigger and is confirmed by publicly available exploit code, though real-world risk is mitigated by high privilege requirements (PR:H) and limited technical impact (integrity only). The product uses rolling releases with no versioning, and the vendor has not responded to early disclosure.
Stored cross-site scripting (XSS) in Cyber-III Student-Management-System via manipulation of the $_SERVER['PHP_SELF'] variable in the batch-notice.php admin file allows authenticated attackers with high privileges to inject malicious scripts. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f, exploitable remotely with user interaction, and publicly available exploit code exists. CVSS score of 4.8 reflects moderate risk constrained by authentication and interaction requirements, though the integrity impact and active public disclosure elevate operational concern.
Reflected cross-site scripting in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows high-privilege authenticated attackers to inject malicious scripts via the $_SERVER['PHP_SELF'] parameter in the admin notice endpoint (/admin/Add%20notice/notice.php). Publicly available exploit code exists, and the vulnerability requires user interaction (UI) to trigger, limiting practical impact despite remote accessibility.
Improper authorization in Cyber-III Student-Management-System allows unauthenticated remote attackers to bypass authentication controls via crafted HTTP POST requests to /viva/update.php. The vulnerability (CWE-285) enables unauthorized modification of student records by manipulating the 'Name' parameter. Publicly available exploit code exists (GitHub issue #236), and the project maintainer has not responded to responsible disclosure attempts. EPSS data not provided, but CVSS 7.3 with PR:N indicates significant risk for internet-facing deployments.