CVE-2026-47324— school-management-system 跨站脚本漏洞

Stored XSS in Multiple Points in ProjectsAndPrograms school-management-system

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker (e.g., a teacher or administrator) can inject malicious JavaScript that is subsequently executed in other users’ browsers. Critically, when chained with CVE‑2025‑11661, which allows unauthenticated access to backend endpoints, this vulnerability can be exploited by a remote attacker without privileges to inject and execute arbitrary JavaScript. The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

school-management-system 跨站脚本漏洞

school-management-system是Shubham kumar个人开发者的一个PHP为学校或小型机构开发的学校管理系统。 school-management-system存在跨站脚本漏洞，该漏洞源于学生和教师对象的多个属性存在存储型跨站脚本，可能导致授权攻击者注入恶意JavaScript并在其他用户浏览器中执行。

N/A

N/A