CVE-2026-7401

SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scripting

View on CVE.org
Published Apr 29, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=register of the component Registration. The manipulation of the argument student_id/full_name/section/username results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.

Analysis

AI-generated

Technical impact

A flaw in the Registration component of SourceCodester’s CET Automated Grading System with AI Predictive Analytics allows an attacker to inject malicious JavaScript through the student_id, full_name, section, or username parameters of the /index.php?action=register endpoint. This injection can lead to stored or reflected XSS attacks that compromise the confidentiality and integrity of user data in the victim’s browser. The underlying weakness corresponds to CWE‑79 and, based on the description, also relates to code injection (CWE‑94).

Affected Systems

The vulnerability exists in SourceCodester’s CET Automated Grading System with AI Predictive Analytics version 1.0. No other versions are documented in the vendor statement.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, and the lack of an EPSS score does not provide insight into exploitation likelihood, though the exploit is publicly available. The attack can be launched remotely through the public Registration page without authentication, and the system is listed as not included in the CISA KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Review and sanitize all input fields (student_id, full_name, section, username) before processing to ensure no script tags are stored.
  • Apply strict output encoding when rendering user‑generated content to the browser to neutralise any embedded scripts.
  • Deploy or update your Web Application Firewall to block known XSS payload patterns and monitor for suspicious activity.

Generated by OpenCVE AI on April 29, 2026 at 21:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester cet Automated Grading System With Ai Predictive Analytics
Vendors & Products Sourcecodester
Sourcecodester cet Automated Grading System With Ai Predictive Analytics
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=register of the component Registration. The manipulation of the argument student_id/full_name/section/username results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.
Title SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 29, 2026, 7:31 PM
Reserved
Apr 29, 2026, 11:41 AM

View source JSON

Updated
Apr 29, 2026, 7:31 PM

JSON

Status
Deferred
Published
Apr 29, 2026, 8:16 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
Apr 30, 2026, 8:20 AM

JSON