Executive brief
The Simple Scheduling System, a web application used for managing schedules, is vulnerable to a security flaw where malicious scripts can be injected into the Subject Description field. If an administrator views the affected entry, the script could execute in their browser, potentially allowing an attacker to steal login session cookies or perform unauthorized actions. This could lead to a full takeover of the scheduling system and exposure of internal scheduling data.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Simple Scheduling System 1.0 due to improper neutralization of user-supplied input in the 'Subject Description' field. An unauthenticated remote attacker can inject malicious JavaScript into this field when adding a new subject. When an administrative user later views the subject information, the payload executes within the context of their browser session. This can be leveraged to exfiltrate session cookies or perform unauthorized administrative actions. The vulnerability is tracked as CWE-79.
Affected products
- code-projects Simple Scheduling System 1.0
Timeline
- 2025-10-09: disclosed
- 2025-10-09: advisory