CVE-2026-105809: Cross Site Scripting in SourceCodester Simple Student Information System

This vulnerability exists in SourceCodester Simple Student Information System 1.0 within the /register.php file's Profile Field Handler component. Specifically, improper handling of the firstname and lastname input parameters allows an attacker to inject malicious scripts, resulting in cross-site scripting. The attack vector is network-based with no privileges required and no user interaction needed to initiate the attack, but user interaction is required to trigger the vulnerability. Exploit code is publicly available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, the impact is limited to the scope of the XSS vulnerability and does not include privilege escalation or direct system compromise.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply input validation and output encoding on the firstname and lastname fields to mitigate exploitation.