Executive brief
A security vulnerability exists in the hemant6488 Student Management System, a web application used for managing student records. An attacker can inject malicious scripts into the system by submitting a specially crafted student name. If an administrator or another user views the student list, the script will execute in their browser, potentially allowing the attacker to steal session information or perform unauthorized actions.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in hemant6488 CodeIgniter-StudentManagementSystem within the Students Controller. The 'addStudent' function in 'view_students.php' fails to sanitize the 'Name' input parameter before storing it in the database. When the student list is subsequently rendered, the application does not perform HTML entity encoding, allowing the execution of arbitrary JavaScript in the context of the victim's browser. This can be exploited remotely without authentication, as the endpoint lacks proper access controls. A public exploit is available, and the vendor has not yet released a patch for this rolling-release software.
Affected products
- hemant6488 CodeIgniter-StudentManagementSystem rolling release
Timeline
- 2026-04-27: disclosed: Issue reported on GitHub repository
- 2026-05-26: advisory: NVD/VulDB advisory published