CVE-2026-5644: Cross Site Scripting in Cyber-III Student-Management-System
CVE-2026-5644 is a cross-site scripting (XSS) vulnerability in the Cyber-III Student-Management-System affecting an unknown function in /admin/Add notice/batch-notice. php. The vulnerability arises from manipulation of the $_SERVER['PHP_SELF'] argument, allowing remote attackers to inject malicious scripts. The product uses continuous delivery with rolling releases, and no specific patched versions have been disclosed. The vendor has been informed but has not yet responded or provided a fix. The CVSS 4. 0 base score is 4. 8, indicating medium severity.
AI Analysis
Technical Summary
This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows remote attackers to perform cross-site scripting by manipulating the $_SERVER['PHP_SELF'] variable in the /admin/Add notice/batch-notice.php file. The flaw enables injection of malicious scripts due to improper input handling. The vulnerability is publicly known, but no official remediation or patch has been released, and the vendor has not responded to the issue report. The system is not a cloud service, and no exploit in the wild has been confirmed.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the CVSS score of 4.8 and the requirement for high privileges (PR:H) and user interaction (UI:P) reduce the overall risk. There is no indication of direct impact on confidentiality, integrity, or availability beyond the XSS scope.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying manual input validation or sanitization on the $_SERVER['PHP_SELF'] variable as a temporary mitigation. Monitoring for updates from the vendor is recommended. No official fix or temporary workaround has been published.
CVE-2026-5644: Cross Site Scripting in Cyber-III Student-Management-System
Description
CVE-2026-5644 is a cross-site scripting (XSS) vulnerability in the Cyber-III Student-Management-System affecting an unknown function in /admin/Add notice/batch-notice. php. The vulnerability arises from manipulation of the $_SERVER['PHP_SELF'] argument, allowing remote attackers to inject malicious scripts. The product uses continuous delivery with rolling releases, and no specific patched versions have been disclosed. The vendor has been informed but has not yet responded or provided a fix. The CVSS 4. 0 base score is 4. 8, indicating medium severity.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows remote attackers to perform cross-site scripting by manipulating the $_SERVER['PHP_SELF'] variable in the /admin/Add notice/batch-notice.php file. The flaw enables injection of malicious scripts due to improper input handling. The vulnerability is publicly known, but no official remediation or patch has been released, and the vendor has not responded to the issue report. The system is not a cloud service, and no exploit in the wild has been confirmed.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the CVSS score of 4.8 and the requirement for high privileges (PR:H) and user interaction (UI:P) reduce the overall risk. There is no indication of direct impact on confidentiality, integrity, or availability beyond the XSS scope.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying manual input validation or sanitization on the $_SERVER['PHP_SELF'] variable as a temporary mitigation. Monitoring for updates from the vendor is recommended. No official fix or temporary workaround has been published.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-05T20:36:14.383Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d387c10a160ebd92a05aed
Added to database: 4/6/2026, 10:15:29 AM
Last enriched: 4/13/2026, 3:07:23 PM
Last updated: 5/23/2026, 5:21:35 PM
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.