CVE-2021-3294
MediumCVSS 5.4Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.
Risk Assessment
The risk involves session hijacking and potential theft of sensitive data, which could compromise the confidentiality and integrity of the system.
Recommendation
Update the system to the latest version and implement input filtering and validation in users.php to prevent script injection.
Other vulnerabilities in CASAP Automated Enrollment System
See all- CVE-2025-67404Critical
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in save_stud.php via the fname, lname, and student_class parameters.
- CVE-2025-67403Critical
SQL Injection vulnerability in CASAP Automated Enrollment System 1.0. An attacker can inject malicious SQL via the class_name parameter in update_class.php.
- CVE-2025-67408High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in /save_user.php via the status parameter.
- CVE-2025-67407High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_student.php via the fname and student_class parameters.
- CVE-2025-67405High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_password.php via the new_password parameter.
- CVE-2021-27332Medium
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.
Original NVD description (English source)
CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a malicious website.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS