# CVE-2026-47324: ProjectsAndPrograms school-management-system Stored XSS in student and teacher objects

Source: https://junglewise.ai/threats/cve-2026-47324-projectsandprograms-school-management-system-stored-xss-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-47324 · Severity: info · CVSS 5.1 · Published 2026-06-03

The ProjectsAndPrograms school-management-system, used for managing educational records, contains a security flaw that allows users to inject malicious scripts into student and teacher profiles. If exploited, an attacker could steal login sessions or perform unauthorized actions when other staff or students view the affected profiles. While normally requiring an account to exploit, this can be combined with other known flaws to allow completely unauthorized attackers to compromise the system.

## Quick answers

**Is CVE-2026-47324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47324 being exploited in the wild.

**How severe is CVE-2026-47324?** Informational severity, with a CVSS score of 5.1, published 3 June 2026.

**Which products and versions are affected?** ProjectsAndPrograms school-management-system commit 6b6fae5 and potentially others.

**Is there a fix for CVE-2026-47324?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47324 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47324?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the ProjectsAndPrograms school-management-system due to improper neutralization of input during web page generation (CWE-79). The flaw resides in multiple attributes of student and teacher objects, allowing an authenticated attacker with teacher or administrator privileges to inject malicious payloads. Notably, this vulnerability can be chained with CVE-2025-11661 (unauthenticated backend access) to allow remote, unauthenticated attackers to inject scripts. The vulnerability was confirmed in the version corresponding to commit 6b6fae5.

## Affected products

- ProjectsAndPrograms school-management-system commit 6b6fae5 and potentially others

## Timeline

- 2026-06-03: advisory: Advisory published by CERT.PL and NVD
- 2026-06-03: disclosed

## References

- [https://cert.pl/en/posts/2026/06/CVE-2026-47324/](https://cert.pl/en/posts/2026/06/CVE-2026-47324/)
- [https://oranbyte.com/projects/school-management-system](https://oranbyte.com/projects/school-management-system)