Description
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-04-06
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Assess Impact
AI Analysis

Impact

A flaw exists in Cyber‑III Student‑Management‑System that allows an attacker to inject arbitrary JavaScript through manipulation of the $_SERVER['PHP_SELF'] value in the /admin/Add%20notice/add%20notice.php page. The vulnerability is a classic client‑side injection (CWE‑79) that can lead to Cross‑Site Scripting. If exploited, the injected script runs in the victim’s browser and could be used to steal data, modify page content, or deface the site. A secondary weakness (CWE‑94) is also present, though the description does not clarify its exploitability.

Affected Systems

The affected product is Cyber‑III Student‑Management‑System. The vulnerability resides in releases built from code up to commit a938fa61e9f735078e9b291d2e6215b4942af3f. No specific version numbers are available because the project uses a rolling release model. Deployments that include the /admin/Add%20notice/add%20notice.php endpoint are potentially impacted.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The CVE notes that the flaw can be triggered remotely by manipulating a URL and that proof‑of‑concept exploit code has been published. The likely attack vector is a remote attacker sending a crafted request to the vulnerable script. As no remediation has been released yet, the risk remains until a patch is applied.

Generated by OpenCVE AI on April 6, 2026 at 20:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify whether your deployment contains the vulnerable commit hash and, if possible, restrict or disable the add‑notice functionality.
  • Apply the latest code from the project’s repository once it is available or upgrade to a patched commit.
  • If immediate update is not feasible, sanitize or escape the $_SERVER['PHP_SELF'] input in the source or replace it with a hard‑coded script name.
  • Deploy a web‑application firewall rule set that blocks common XSS payloads on the affected URL.
  • Monitor the project’s issue tracker and vulnerability databases for a fix and plan to upgrade as soon as a patched release is released.

Generated by OpenCVE AI on April 6, 2026 at 20:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Cyber-iii
Cyber-iii student-management-system
Vendors & Products Cyber-iii
Cyber-iii student-management-system

Mon, 06 Apr 2026 20:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Title Cyber-III Student-Management-System add%20notice.php cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Cyber-iii Student-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T18:45:01.460Z

Reserved: 2026-04-06T08:14:03.365Z

Link: CVE-2026-5668

cve-icon Vulnrichment

Updated: 2026-04-06T18:44:57.921Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-06T17:17:15.050

Modified: 2026-04-07T13:20:11.643

Link: CVE-2026-5668

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:31:40Z

Weaknesses