Executive brief
A security vulnerability exists in the StudentManagementSystem, a web application used for managing student records. An attacker can inject malicious scripts into the system through the student registration or profile page. If a school administrator or another user views the affected student record, the script could execute in their browser, potentially leading to unauthorized actions or data theft within the application.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in yashpokharna2555 StudentManagementSystem at commit cb2f558. The vulnerability is located in the student.php file and is triggered by improper neutralization of the FIRST_NAME input parameter. A remote attacker with low privileges can submit a crafted string containing JavaScript, which is then stored in the database. When other users access the affected student record, the script executes in their browser context. As of the advisory date, no official patch has been released by the maintainer, although the issue has been publicly disclosed.
Affected products
- yashpokharna2555 StudentManagementSystem commit cb2f558ddf8d19396de0f92abf2d224d46a0a203
Timeline
- 2026-05-25: disclosed: Vulnerability disclosed via GitHub issue and VulDB.
- 2026-05-25: advisory: CVE-2026-9471 published.