CVE-2026-9471

LOW

yashpokharna2555 StudentManagementSystem student.php cross site scripting

Title source: cna
STIX 2.1

Description

A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file /student.php. Performing a manipulation of the argument FIRST_NAME results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-365452 | yashpokharna2555 StudentManagementSystem student.php cross site scripting
https://vuldb.com/vuln/365452
Signature, Permissions Required signature permissions-required
VDB-365452 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/365452/cti
Third Party Advisory third-party-advisory
Submit #814002 | Yash Pokharna StudentManagementSystem 1.0 Stored Cross-Site Scripting
https://vuldb.com/submit/814002

Scores

CVSS v3 3.5
EPSS 0.0025
EPSS Percentile 15.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
yashpokharna2555/StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203
Published May 25, 2026
Tracked Since May 25, 2026