CVE-2026-104612
MediumCVSS 4.3Summary
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Student Result Management System 1.0 in the Announcement Module, in the file script/academic/core/new_announcement.php, affecting the title/announcement arguments. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
It is recommended to validate and sanitize input data in new_announcement.php and apply appropriate anti-XSS filters.
Other vulnerabilities in SourceCodester Student Result Management System
Original NVD description (English source)
A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS