# CVE-2026-95957: SourceCodester Smart Attendance System cross-site scripting in registration

Source: https://junglewise.ai/threats/cve-2026-95957-a-vulnerability-was-found-in-sourcecodester-smart-attendance  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95957 · Severity: medium · CVSS 4.3 · Published 2026-09-23

SourceCodester Smart Attendance System with QR Code Scanner is a web application for managing student attendance. An attacker can inject malicious code through the student sign-up form's full name field, which is reflected back to users without sanitization. This could allow attackers to steal session credentials, redirect users to phishing sites, or perform actions on behalf of affected users.

Technologies: [SourceCodester Smart Attendance System with QR Code Scanner](https://junglewise.ai/threats/technologies/smart-attendance-system-with-qr-code-scanner). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-95957 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95957 being exploited in the wild.

**How severe is CVE-2026-95957?** Medium severity, with a CVSS score of 4.3, published 23 September 2026.

**Which products and versions are affected?** SourceCodester Smart Attendance System with QR Code Scanner 1.0.

**Is there a fix for CVE-2026-95957?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-95957 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-95957?** Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the student_signup.php file's self-registration component. The full_name parameter is prepended to output without proper HTML encoding or validation, allowing injection of arbitrary JavaScript. Remote exploitation requires user interaction (victim accessing the malicious link) but no authentication.

## Affected products

- SourceCodester Smart Attendance System with QR Code Scanner 1.0

## Timeline

- 2026-09-23: disclosed

## References

- [https://github.com/Jack-MRJ/Smart-Attendance-System-with-QR-Code-Scanner](https://github.com/Jack-MRJ/Smart-Attendance-System-with-QR-Code-Scanner)
- [https://vuldb.com/cve/CVE-2026-95957](https://vuldb.com/cve/CVE-2026-95957)

## Related threats

- [SourceCodester Smart Attendance System reflected XSS in reset_password.php](https://junglewise.ai/threats/cve-2026-127282-a-vulnerability-was-determined-in-sourcecodester-smart)
- [SourceCodester Smart Attendance System session fixation in login.php](https://junglewise.ai/threats/cve-2026-125078-a-security-flaw-has-been-discovered-in-sourcecodester-smart)
- [SourceCodester Smart Attendance System cross-site request forgery in student deletion](https://junglewise.ai/threats/cve-2026-125077-a-vulnerability-was-determined-in-sourcecodester-smart)
- [SourceCodester Smart Attendance System missing authentication in JSON endpoint](https://junglewise.ai/threats/cve-2026-125076-a-vulnerability-was-found-in-sourcecodester-smart-attendance)
- [SourceCodester Smart Attendance System auth bypass in admin account creation](https://junglewise.ai/threats/cve-2026-125075-a-vulnerability-has-been-found-in-sourcecodester-smart)