Description
A vulnerability was identified in SourceCodester Student Grades Management System 1.0. Affected by this issue is some unknown functionality of the file students.php. The manipulation of the argument Remarks leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Published: 2026-05-25
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises because the Remarks parameter in students.php is reflected without proper output encoding. An attacker can inject arbitrary HTML or JavaScript, resulting in reflected cross‑site scripting that can execute in the victim’s browser, potentially leading to session hijacking, credential theft, or defacement. The flaw is classified as CWE‑79 and is related to code injection (CWE‑94).

Affected Systems

The affected application is SourceCodester Student Grades Management System, version 1.0, deployed by SourceCodester. Only the students.php Remarks feature is impacted; no other versions or modules are listed as affected.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The exploit can be triggered remotely by sending a crafted request to students.php with a malicious Remarks value, and it is publicly documented. Given the medium score and public exploit, organizations should treat this as a notable risk until mitigated.

Generated by OpenCVE AI on May 25, 2026 at 20:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy a temporary patch that sanitizes the Remarks parameter output by applying proper escaping such as htmlspecialchars or an equivalent function.
  • Implement a Content Security Policy that blocks inline scripts and limits script sources to trusted origins.
  • Perform regular web‑application security scans to detect anomalous script injections and review input validation logic to ensure future changes do not reintroduce the flaw.

Generated by OpenCVE AI on May 25, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 26 May 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 25 May 2026 19:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in SourceCodester Student Grades Management System 1.0. Affected by this issue is some unknown functionality of the file students.php. The manipulation of the argument Remarks leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Title SourceCodester Student Grades Management System students.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester student Grades Management System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:student_grades_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester student Grades Management System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Student Grades Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-26T12:38:45.429Z

Reserved: 2026-05-24T09:26:27.614Z

Link: CVE-2026-9485

cve-icon Vulnrichment

Updated: 2026-05-26T12:38:37.187Z

cve-icon NVD

Status : Deferred

Published: 2026-05-25T20:16:37.827

Modified: 2026-05-26T19:37:00.120

Link: CVE-2026-9485

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-25T20:30:26Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')