CVE-2025-51967

MediumCVSS 6.1

Published: 28/08/2025(UTC)Updated: 26/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

A reflected cross-site scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails to sanitize user-supplied input in the theme POST parameter, allowing an attacker to inject and execute arbitrary JavaScript in a victim's browser.

Risk Assessment

Risk includes execution of malicious scripts in the victim's browser, potentially leading to data theft, session hijacking, or other attacks.

Recommendation

Update the system to a patched version and implement input validation and sanitization.

Other vulnerabilities in ProjectsAndPrograms School Management System

CVE-2026-5472Medium
The ProjectsAndPrograms School Management System up to version 6b6fae5426044f89c08d0dd101c7fa71f9042a59 contains an unrestricted file upload vulnerability in the Profile Picture Handler component in /admin_panel/settings.php. Manipulation of the File argument allows remote uploading of arbitrary files without proper restrictions.

Original NVD description (English source)

A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails to sanitize user-supplied input in the theme POST parameter, allowing an attacker to inject and execute arbitrary JavaScript in a victim's browser.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS