# CVE-2026-97650: ningzichun student-management-system stored cross-site scripting in log

Source: https://junglewise.ai/threats/cve-2026-97650-a-vulnerability-has-been-found-in-ningzichun-student-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97650 · Severity: medium · CVSS 4.3 · Published 2026-09-25

The student-management-system is a web application for managing student course selections and disciplinary records. An attacker can inject malicious JavaScript code into student log entries through the log creation form, which is then executed in the browser of administrators or students viewing those logs, allowing account takeover or unauthorized actions.

Technologies: [Ningzichun Student-Management-System](https://junglewise.ai/threats/technologies/ningzichun-student-management-system). Vendors: [Ningzichun](https://junglewise.ai/threats/vendors/ningzichun).

## Quick answers

**Is CVE-2026-97650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97650 being exploited in the wild.

**How severe is CVE-2026-97650?** Medium severity, with a CVSS score of 4.3, published 25 September 2026.

**Which products and versions are affected?** Ningzichun Student-Management-System up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.

**Is there a fix for CVE-2026-97650?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97650 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97650?** Check whether you run Ningzichun Student-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting vulnerability exists in the log creation and display functionality (admin/fun/addLog.php and admin/fun/getLog.php). User-supplied POST parameters (reason and detail) are stored in the database without sanitization and later rendered in HTML via echo statements without output encoding. An attacker can POST malicious HTML/JavaScript to the log creation endpoint and execute arbitrary scripts in the context of any user viewing the logs.

## Affected products

- ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf

## Timeline

- 2026-07-18: disclosed: Vulnerability reported via GitHub issue
- 2026-09-25: advisory: CVE-2026-97650 published

## References

- [https://github.com/ningzichun/student-management-system/](https://github.com/ningzichun/student-management-system/)
- [https://github.com/ningzichun/student-management-system/issues/11](https://github.com/ningzichun/student-management-system/issues/11)

## Related threats

- [ningzichun student-management-system default credentials in sample database](https://junglewise.ai/threats/cve-2026-97649-a-flaw-has-been-found-in-ningzichun-student-management-system-up)
- [ningzichun student-management-system CSRF in course withdrawal](https://junglewise.ai/threats/cve-2026-97648-a-vulnerability-was-detected-in-ningzichun-student-management)
- [ningzichun student-management-system authorization bypass in user/editLog.php](https://junglewise.ai/threats/cve-2026-97647-a-security-vulnerability-has-been-detected-in-ningzichun-student)
- [Ningzichun student-management-system authorization bypass in admin handlers](https://junglewise.ai/threats/cve-2026-97646-a-weakness-has-been-identified-in-ningzichun-student-management)