CVE-2021-27332
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the victim's browser context, compromising data confidentiality and integrity.
Recommendation
Update the system to the latest version or implement input filtering and validation for the class_name parameter in update_class.php.
Other vulnerabilities in CASAP Automated Enrollment System
See all- CVE-2025-67404Critical
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in save_stud.php via the fname, lname, and student_class parameters.
- CVE-2025-67403Critical
SQL Injection vulnerability in CASAP Automated Enrollment System 1.0. An attacker can inject malicious SQL via the class_name parameter in update_class.php.
- CVE-2025-67408High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in /save_user.php via the status parameter.
- CVE-2025-67407High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_student.php via the fname and student_class parameters.
- CVE-2025-67405High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_password.php via the new_password parameter.
- CVE-2021-3294Medium
CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS