CVE-2025-11485
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability in SourceCodester Student Grades Management System 1.0 affects the add_user function in /admin.php of the Manage Users Page component. Manipulation of first_name/last_name arguments causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed.
Risk Assessment
An attacker can inject malicious scripts that execute in the administrator's browser, potentially leading to session theft or unauthorized changes.
Recommendation
Apply input sanitization and encoding, and update the system to a patched version.
Other vulnerabilities in Student Grades Management System
See all- CVE-2026-9484Medium
In SourceCodester Student Grades Management System 1.0, an improper authorization vulnerability exists in the getClassroomStudents/removeStudentFromClassroom function of classroom.php. Manipulating the classroom_id argument leads to authorization bypass. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-9483Medium
SourceCodester Student Grades Management System 1.0 has a vulnerability in grades.php where manipulation of the student_id argument leads to improper authorization. The attack can be performed remotely and the exploit is public.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function add_user of the file /admin.php of the component Manage Users Page. This manipulation of the argument first_name/last_name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS