CVE-2023-41519 - Reflected XSS in Student Attendance Management System v1 Description Student Attendance Management System v1 is affected by a reflected cross-site scripting (XSS) vulnerability in the parameter of the file. The parameter value is rendered directly into the HTML response without proper sanitization or encoding, making it possible for attackers to inject malicious JavaScript. Proof of Concept A reflected XSS payload such as the following demonstrates the vulnerability: . When this payload is supplied to the parameter, it is echoed back unmodified in the HTML response, allowing arbitrary JavaScript to execute in the user's browser context. Vulnerability Type Reflected Cross-Site Scripting (XSS) Affected Product Product Name: Student Attendance Management System Version: v1 Component: createSessionTerm.php Vendor: GitHub Repository: https://github.com/rickxy/Student-Attendance-Management-System Technical Details Affected Path: /Student-Attendance-Management-System-main/Admin/createSessionTerm.php Parameter: sessionName Severity: High Confidence: Certain Host (during test): http://localhost Attack Details Attack Type: Remote Attack Vector: User-supplied input to the parameter in a web form or URL Impact: Arbitrary code execution in the browser (XSS) References https://github.com/rickxy/Student-Attendance-Management-System Discoverers Chaima EL BAHRAQUI