Executive brief
A security vulnerability exists in stumasy, a student management and social networking platform. The system fails to properly clean user-provided dictionary references, allowing a malicious user to inject scripts that run in other users' browsers. This could allow an attacker to perform unauthorized actions on behalf of other students or staff, potentially leading to account takeover or data manipulation.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in mjperpinosa stumasy up to commit 327d1b0f. The flaw is located in the add_definition function within application/PHP/objects/notes/add_into_dictionary.php, where the 'reference' parameter is stored without adequate sanitization. When the dictionary entry is later retrieved, the application fails to encode the output, and the frontend (notes.js) inserts the raw server response into the DOM using the jQuery .html() method. A remote authenticated attacker can exploit this by submitting a malicious payload in the reference field, which executes arbitrary JavaScript in the context of any user viewing the affected dictionary entry. As of the advisory date, no official patch has been released.
Affected products
- mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be
Timeline
- 2026-06-05: disclosed: Issue reported to the project maintainer via GitHub issue #8
- 2026-07-05: advisory: CVE-2026-14752 published via VulDB/NVD