Executive brief
A vulnerability exists in the Student Management System, a tool used by schools to track student data and grades. An attacker can inject malicious scripts into the dashboard pages used by administrators, teachers, and students. If an authorized user views the affected dashboard, the script could execute in their browser, potentially leading to unauthorized actions or the theft of session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Dashboard Page component of sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. The application fails to sanitize or encode the 'Name' argument before echoing it into HTML input attributes within admin_dashboard.php, student_dashboard.php, and teacher_dashboard.php. A remote attacker with the ability to modify student or teacher names (potentially via other unauthorized data insertion flaws) can inject a malicious payload. When a victim (admin, teacher, or student) views the dashboard, the payload executes in their browser context. As of the advisory date, the project maintainer has not responded to the issue report.
Affected products
- sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0
Timeline
- 2026-05-03: disclosed: Issue reported on GitHub repository
- 2026-05-30: advisory: CVE published and added to NVD