# CVE-2026-9471: yashpokharna2555 StudentManagementSystem XSS in student.php

Source: https://junglewise.ai/threats/cve-2026-9471-yashpokharna2555-studentmanagementsystem-xss-in-student-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9471 · Severity: low · CVSS 3.5 · Published 2026-05-25

A security vulnerability exists in the StudentManagementSystem, a web application used for managing student records. An attacker can inject malicious scripts into the system through the student registration or profile page. If a school administrator or another user views the affected student record, the script could execute in their browser, potentially leading to unauthorized actions or data theft within the application.

Technologies: [Yashpokharna2555 StudentManagementSystem](https://junglewise.ai/threats/technologies/studentmanagementsystem). Vendors: [Yashpokharna2555](https://junglewise.ai/threats/vendors/yashpokharna2555).

## Quick answers

**Is CVE-2026-9471 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9471 being exploited in the wild.

**How severe is CVE-2026-9471?** Low severity, with a CVSS score of 3.5, published 25 May 2026.

**Which products and versions are affected?** Yashpokharna2555 StudentManagementSystem commit cb2f558ddf8d19396de0f92abf2d224d46a0a203.

**Is there a fix for CVE-2026-9471?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9471 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9471?** Check whether you run Yashpokharna2555 StudentManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in yashpokharna2555 StudentManagementSystem at commit cb2f558. The vulnerability is located in the student.php file and is triggered by improper neutralization of the FIRST_NAME input parameter. A remote attacker with low privileges can submit a crafted string containing JavaScript, which is then stored in the database. When other users access the affected student record, the script executes in their browser context. As of the advisory date, no official patch has been released by the maintainer, although the issue has been publicly disclosed.

## Affected products

- yashpokharna2555 StudentManagementSystem commit cb2f558ddf8d19396de0f92abf2d224d46a0a203

## Timeline

- 2026-05-25: disclosed: Vulnerability disclosed via GitHub issue and VulDB.
- 2026-05-25: advisory: CVE-2026-9471 published.

## References

- [https://github.com/yashpokharna2555/StudentManagementSystem/](https://github.com/yashpokharna2555/StudentManagementSystem/)
- [https://github.com/yashpokharna2555/StudentManagementSystem/issues/4](https://github.com/yashpokharna2555/StudentManagementSystem/issues/4)
- [https://vuldb.com/submit/814002](https://vuldb.com/submit/814002)
- [https://vuldb.com/vuln/365452](https://vuldb.com/vuln/365452)
- [https://vuldb.com/vuln/365452/cti](https://vuldb.com/vuln/365452/cti)

## Related threats

- [yashpokharna2555 StudentManagementSystem SQL injection in student_trans.php](https://junglewise.ai/threats/cve-2026-9470-yashpokharna2555-studentmanagementsystem-sql-injection-in-student)
- [yashpokharna2555 StudentManagementSystem SQL injection in success.php](https://junglewise.ai/threats/cve-2026-9469-yashpokharna2555-studentmanagementsystem-sql-injection-in-success)