| Titre | Cyber-III Student-Management-System 1.0 XSS vulnerability |
|---|
| Description | The class schedule deletion endpoint /admin/class schedule/delete_batch.php lacks proper administrator permission checks (unauthorized access vulnerability). Additionally, the batch parameter from the POST request is directly concatenated into the HTML response without any HTML escaping (e.g., htmlspecialchars), leading to a reflected Cross‑Site Scripting (XSS) vulnerability. |
|---|
| La source | ⚠️ https://github.com/Cyber-III/Student-Management-System/issues/242 |
|---|
| Utilisateur | zsmaaa (UID 93294) |
|---|
| Soumission | 23/03/2026 08:21 (il y a 7 mois) |
|---|
| Modérer | 06/04/2026 10:14 (14 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 355493 [Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php batch cross site scripting] |
|---|
| Points | 20 |
|---|