SourceCodester Student Result Management System 1.0 contains a cross-site scripting vulnerability in the Announcement Module, specifically in the script/academic/core/new_announcement.php file. The vulnerability is due to improper handling of the title/announcement argument, enabling remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability is identified as CWE-79 and has been assigned CVE-2026-104612. The CVSS v3.1 base score is 4.3, reflecting low severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to integrity only.

Successful exploitation of this vulnerability could allow an attacker to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the affected application. This could result in limited integrity impact such as unauthorized modification of displayed content. There is no confidentiality or availability impact indicated. The attack requires user interaction and can be launched remotely.

No official patch or remediation information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted input in the Announcement Module and consider implementing web application firewall (WAF) rules to detect and block XSS payloads targeting the vulnerable parameter.