CVE-2026-5644: Cross Site Scripting in Cyber-III Student-Management-System
A security flaw has been discovered in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Affected is an unknown function of the file /admin/Add%20notice/batch-notice.php. Performing a manipulation of the argument $_SERVER['PHP_SELF'] results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AI Analysis
Technical Summary
This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows remote attackers to perform cross-site scripting by manipulating the $_SERVER['PHP_SELF'] variable in the /admin/Add notice/batch-notice.php file. The flaw enables injection of malicious scripts due to improper handling of this server variable. The product uses continuous delivery with rolling releases, so specific affected or fixed versions are not clearly identified. The vendor has been informed but has not issued a fix or advisory.
Potential Impact
Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially enabling session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and privileges (PR:H) but can be triggered remotely. No direct evidence of active exploitation in the wild is reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation or web application firewall (WAF) rules to block malicious payloads targeting the $_SERVER['PHP_SELF'] parameter. Monitor vendor channels for updates or patches.
CVE-2026-5644: Cross Site Scripting in Cyber-III Student-Management-System
Description
A security flaw has been discovered in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Affected is an unknown function of the file /admin/Add%20notice/batch-notice.php. Performing a manipulation of the argument $_SERVER['PHP_SELF'] results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows remote attackers to perform cross-site scripting by manipulating the $_SERVER['PHP_SELF'] variable in the /admin/Add notice/batch-notice.php file. The flaw enables injection of malicious scripts due to improper handling of this server variable. The product uses continuous delivery with rolling releases, so specific affected or fixed versions are not clearly identified. The vendor has been informed but has not issued a fix or advisory.
Potential Impact
Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially enabling session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and privileges (PR:H) but can be triggered remotely. No direct evidence of active exploitation in the wild is reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation or web application firewall (WAF) rules to block malicious payloads targeting the $_SERVER['PHP_SELF'] parameter. Monitor vendor channels for updates or patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-05T20:36:14.383Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d387c10a160ebd92a05aed
Added to database: 4/6/2026, 10:15:29 AM
Last enriched: 4/6/2026, 10:30:26 AM
Last updated: 4/8/2026, 6:30:34 AM
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.