CVE-2026-104612 - Vulnerability Details

- SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting

Description

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Published: 2026-10-02

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability allows attackers to inject malicious script through the title/announcement parameter in the new_announcement.php file. By manipulating that input, an attacker can execute arbitrary JavaScript in the context of the web application, potentially stealing session cookies or performing actions on behalf of victims. The flaw is a classic reflected XSS and is exploitable remotely, with the attacker only needing to supply a crafted URL or form entry.

Affected Systems

SourceCodester Student Result Management System version 1.0, specifically the Announcement Module’s script/academic/core/new_announcement.php. The attack vector is the title/announcement input field that is not properly sanitized, allowing cross‑site scripting.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but a public exploit is available, meaning remote attackers could use it easily if the affected software is in use.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SourceCodester

Student Result Management System

affected

Version	Status	Constraints
`1.0`	affected	—

No data.

Vendor Product Confidence Versions

Sourcecodester

Student Result Management System

100%

Version	Status	Scheme	Platform
`1.0`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade SourceCodester Student Result Management System to an official patch that sanitizes the title/announcement input, or apply a vendor update if one is released.
If an immediate update is not feasible, implement server‑side input validation to strip or encode JavaScript tags from the title and announcement fields, thereby preventing script execution.
As a temporary restriction, disable the Announcement Module or restrict access to the new_announcement interface until the patch or sanitization is applied.

Generated by OpenCVE AI on October 2, 2026 at 15:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00273.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Jack-MRJ/srms-vulnerabilities/blob/main/SRMS_Stored_XSS_VulDB_CVE_Report_v1.pdf
https://vuldb.com/cve/CVE-2026-104612
https://vuldb.com/submit/963426
https://vuldb.com/vuln/412921
https://vuldb.com/vuln/412921/cti
https://www.sourcecodester.com/

History

Tue, 06 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 02 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Title		SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting
First Time appeared		Sourcecodester Sourcecodester student Result Management System
Weaknesses		CWE-79 CWE-94
CPEs		cpe:2.3:a:sourcecodester:student_result_management_system::::::::
Vendors & Products		Sourcecodester Sourcecodester student Result Management System
References		https://github.com/Jack-MRJ/srms-vulnerabilities/blob/main/SRMS_Stored_XSS_VulDB_CVE_Report_v1.pdf https://vuldb.com/cve/CVE-2026-104612 https://vuldb.com/submit/963426 https://vuldb.com/vuln/412921 https://vuldb.com/vuln/412921/cti https://www.sourcecodester.com/
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Sourcecodester Student Result Management System

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-02T12:45:16.441Z

Updated: 2026-10-06T16:28:01.507Z

Reserved: 2026-10-02T04:15:45.284Z

Link: CVE-2026-104612

Vulnrichment

Updated: 2026-10-06T16:27:58.110Z

NVD

Status : Deferred

Published: 2026-10-02T13:17:44.820

Modified: 2026-10-06T17:17:15.257

Link: CVE-2026-104612

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-02T15:15:07Z

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94
Improper Control of Generation of Code ('Code Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object