CVE-2026-5668
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft or other actions in the user's context. Since the exploit is publicly available, the risk of exploitation is high.
Recommendation
Update the system to the latest version if available. Otherwise, implement input validation and output encoding, and consider a WAF to block XSS attempts.
Other vulnerabilities in Cyber-III Student-Management-System
See all- CVE-2026-5671Medium
The Cyber-III Student-Management-System has an XSS vulnerability in the file /admin/class%20schedule/delete_batch.php. Manipulation of the batch argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-5670Medium
In Cyber-III Student-Management-System, the move_uploaded_file function in /AssignmentSection/submission/upload.php allows unrestricted file upload via manipulation of the File argument. The attack can be initiated remotely and a public exploit is already available.
Original NVD description (English source)
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS