Quick answers
- Is CVE-2026-11337 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11337 being exploited in the wild.
- How severe is CVE-2026-11337?
- Medium severity, with a CVSS score of 4.3, published 5 June 2026.
- Which products and versions are affected?
- tittuvarghese CollegeManagementSystem commit 3e476335cfbfb9a049e09f474c7ec885f69a9df3.
- Is there a fix for CVE-2026-11337?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-11337 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-11337?
- Check whether you run Tittuvarghese College Management System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the fetch_subject_data action within /dashboard_page/forms/fetch.php. The application fails to sanitize or output-encode the 'department_name' POST parameter before echoing it into an HTML table cell (<td>). An attacker can exploit this by crafting a malicious POST request that, when processed and rendered by a victim's browser (typically via an AJAX callback), executes arbitrary JavaScript. This can lead to session hijacking, CSRF, or unauthorized data modification. As of the advisory date, the project operates on a rolling release basis and has not yet responded to the reported issue.
Affected products
- tittuvarghese CollegeManagementSystem commit 3e476335cfbfb9a049e09f474c7ec885f69a9df3
Timeline
- 2026-05-18: disclosed: Issue reported on GitHub repository
- 2026-06-05: advisory: CVE published to NVD