CVE-2021-27332
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the victim's browser context, compromising data confidentiality and integrity.
Recommendation
Update the system to the latest version or implement input filtering and validation for the class_name parameter in update_class.php.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.