CVE-2026-37750
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A reflected Cross-Site Scripting (XSS) vulnerability was found in the School Management System by mahmoudai1. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser via the unsanitized type parameter in register.php.
Risk Assessment
An attacker can hijack user sessions, steal credentials, or perform other malicious actions in the victim's context, compromising the confidentiality and integrity of data in the system.
Recommendation
Immediately update the system to the latest version or apply a security patch that properly sanitizes input in the type parameter in register.php.
Original NVD description (English source)
A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim's browsers via the unsanitized type parameter in register.php.