The vulnerability CVE-2026-104612 affects SourceCodester Student Result Management System 1.0. It is a cross-site scripting (XSS) issue in the Announcement Module's new_announcement.php script, where the title or announcement parameter is not properly sanitized. This allows remote attackers to inject malicious scripts that execute in the context of the victim's browser when they view the announcement. The vulnerability requires no privileges and no user authentication but does require user interaction to trigger the script. The exploit code has been made public.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of users viewing the announcement page. This can lead to session hijacking, defacement, or redirection to malicious sites. However, the attack requires user interaction and does not grant direct system access or privilege escalation.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with announcements and consider implementing input validation or sanitization on the affected parameter if possible.