| शीर्षक | SapneshNaik Student-Management-System V1.0 Reflected XSS |
|---|
| विवरण | The XSS vulnerability exists in the project’s `index.php` and `admin.php` files (root directory of the project). Both pages have the same backend processing logic for the `error` GET parameter, leading to the same XSS vulnerability.
The XSS vulnerability is caused by improper handling of the user-controlled `error` GET parameter in both `index.php` and `admin.php` files. The backend code directly outputs the value of the`error` parameter to the HTML page without any input validation, sanitization, or encoding (e.g., using the `htmlspecialchars()` function). This allows attackers to construct malicious XSS payloads, which are executed when the page is rendered in the user’s browser. |
|---|
| स्रोत | ⚠️ https://github.com/duckpigdog/CVE/blob/main/XSS%E2%80%94%E2%80%94SapneshNaik_Student-Management-System.md |
|---|
| उपयोगकर्ता | suc2es2 (UID 90074) |
|---|
| सबमिशन | 07/02/2026 07:40 PM (8 महीनों पहले) |
|---|
| संयम | 21/02/2026 06:28 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 347313 [SapneshNaik Student Management System तक f4b4f0928f0b5551a28ee81ae7e7fe47d9345318 index.php error क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|