| शीर्षक | ITSOURCECODE Student Management System 1.0 Improper Neutralization of Alternate XSS Syntax |
|---|
| विवरण | The ITSOURCECODE Student Management System version 1.0, developed and distributed by ITSOURCECODE, is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Add Student module, specifically within the Student Profile Picture file upload functionality. The application allows users with administrative access to upload SVG files without performing adequate server-side validation or sanitization. Because SVG is an XML-based format capable of embedding JavaScript, a malicious payload uploaded as a student profile image is stored on the server and later rendered by the browser. When the uploaded image is accessed through the Manage Student module or opened directly in a new browser tab, the embedded JavaScript executes in the context of the application, resulting in persistent client-side code execution and exposing authenticated users to security risks. |
|---|
| स्रोत | ⚠️ https://github.com/AS-AbdulSamad/CVE-1/tree/main |
|---|
| उपयोगकर्ता | AS-AbdulSamad (UID 95469) |
|---|
| सबमिशन | 10/02/2026 10:57 PM (8 महीनों पहले) |
|---|
| संयम | 21/02/2026 04:14 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 347311 [itsourcecode Student Management System 1.0 Add Student /add_student/ क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|