Executive brief
Igweze wizgrade, a school management system, is vulnerable to a security flaw in its student conduct management component. An attacker could use this flaw to perform cross-site scripting (XSS), potentially allowing them to execute malicious scripts in the browser of an authorized user. This could lead to unauthorized actions being performed on behalf of users or the theft of session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in Igweze wizgrade up to commit b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. The flaw is located within the dashboard/studentConductManager.php file due to improper neutralization of user-supplied input. A remote, unauthenticated attacker can exploit this by tricking a user into visiting a malicious URL or submitting a crafted request, leading to the execution of arbitrary JavaScript in the context of the victim's browser session. The vendor has not responded to disclosure attempts, and the software uses a rolling release model.
Affected products
- igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6
Timeline
- 2026-07-12: advisory: Public disclosure via VulDB and NVD
- 2026-07-12: disclosed: Exploit disclosed publicly