Is CVE-2026-127282 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127282 being exploited in the wild.

How severe is CVE-2026-127282?

Medium severity, with a CVSS score of 4.3, published 13 November 2026.

Is there a fix for CVE-2026-127282?

No fixed version is recorded yet. Apply HTML entity encoding (htmlspecialchars with ENT_QUOTES flag) to the username variable before embedding it into the success message output. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-127282 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-127282?

Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127282: SourceCodester Smart Attendance System reflected XSS in reset_password.php

CVE-2026-127282 · Severity: medium · CVSS 4.3 · Published 2026-11-13

SourceCodester Smart Attendance System is a web-based attendance tracking application with QR code scanner functionality. An unauthenticated reflected cross-site scripting (XSS) vulnerability in the password reset page allows attackers to inject malicious JavaScript that executes in users' browsers, enabling cookie theft or impersonation attacks if victims are tricked into submitting a specially crafted form.

Technologies: SourceCodester Smart Attendance System with QR Code Scanner. Vendors: SourceCodester.

Quick answers

Is CVE-2026-127282 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127282 being exploited in the wild.
How severe is CVE-2026-127282?: Medium severity, with a CVSS score of 4.3, published 13 November 2026.
Which products and versions are affected?: SourceCodester Smart Attendance System with QR Code Scanner 1.0.
Is there a fix for CVE-2026-127282?: No fixed version is recorded yet. Apply HTML entity encoding (htmlspecialchars with ENT_QUOTES flag) to the username variable before embedding it into the success message output. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-127282 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-127282?: Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Apply HTML entity encoding (htmlspecialchars with ENT_QUOTES flag) to the username variable before embedding it into the success message output.

Technical details

The vulnerability is a reflected XSS in reset_password.php where the username POST parameter is embedded directly into the success message without HTML encoding (htmlspecialchars). Because the endpoint is unauthenticated, any attacker can trigger the vulnerability by hosting a page with an auto-submitting form. The payload is reflected verbatim into the HTML response, allowing arbitrary JavaScript execution in the victim's browser context.

Affected products

SourceCodester Smart Attendance System with QR Code Scanner 1.0

Timeline

2026-11-13: disclosed
2026-10-17: other: Vulnerability identified during security audit

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.