| शीर्षक | Cyber-III Student-Management-System 1.0 XSS vulnerability |
|---|
| विवरण | The class schedule deletion endpoint /admin/class schedule/delete_batch.php lacks proper administrator permission checks (unauthorized access vulnerability). Additionally, the batch parameter from the POST request is directly concatenated into the HTML response without any HTML escaping (e.g., htmlspecialchars), leading to a reflected Cross‑Site Scripting (XSS) vulnerability. |
|---|
| स्रोत | ⚠️ https://github.com/Cyber-III/Student-Management-System/issues/242 |
|---|
| उपयोगकर्ता | zsmaaa (UID 93294) |
|---|
| सबमिशन | 23/03/2026 08:21 AM (7 महीनों पहले) |
|---|
| संयम | 06/04/2026 10:14 AM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355493 [Cyber-III Student-Management-System तक 1a938fa61e9f735078e9b291d2e6215b4942af3f Class Schedule Deletion Endpoint delete_batch.php batch क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|