Executive brief
A vulnerability exists in the Cyber-III Student Management System, a platform used for managing university student records and schedules. An attacker can trick a user into clicking a malicious link, allowing the attacker to execute unauthorized scripts in the user's browser. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f. The issue is located in the '/admin/class schedule/delete_batch.php' file, where the 'batch' POST parameter is directly concatenated into the HTML response without proper sanitization or escaping (e.g., via htmlspecialchars). Additionally, the endpoint lacks proper authentication and authorization checks, allowing remote attackers to trigger the vulnerability without valid administrator credentials. An attacker can exploit this by crafting a malicious request that executes arbitrary JavaScript in the context of a victim's browser session. As of the advisory date, no official patch has been released.
Affected products
- Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f
Timeline
- 2026-03-23: disclosed: Issue reported on GitHub repository
- 2026-04-06: advisory: CVE published