CVE-2026-5668: Cross Site Scripting in Cyber-III Student-Management-System
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AI Analysis
Technical Summary
This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows remote attackers to perform cross-site scripting via manipulation of the $_SERVER['PHP_SELF'] variable in the /admin/Add notice/add notice.php file. The flaw enables injection of malicious scripts due to insufficient input validation or sanitization of this server variable. The vulnerability is publicly known with an exploit published, but no patch or fix has been released yet. The rolling release nature of the product means no fixed version is identified, and the vendor has not provided remediation details.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and privileges (PR:H) but does not require user authentication (AT:N). The impact is limited to client-side script execution with low integrity impact and no confidentiality or availability impact as per the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the Cyber-III project. As a temporary measure, administrators may consider applying manual input validation or sanitization on the $_SERVER['PHP_SELF'] variable if feasible, or restrict access to the affected functionality until a fix is available.
CVE-2026-5668: Cross Site Scripting in Cyber-III Student-Management-System
Description
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows remote attackers to perform cross-site scripting via manipulation of the $_SERVER['PHP_SELF'] variable in the /admin/Add notice/add notice.php file. The flaw enables injection of malicious scripts due to insufficient input validation or sanitization of this server variable. The vulnerability is publicly known with an exploit published, but no patch or fix has been released yet. The rolling release nature of the product means no fixed version is identified, and the vendor has not provided remediation details.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and privileges (PR:H) but does not require user authentication (AT:N). The impact is limited to client-side script execution with low integrity impact and no confidentiality or availability impact as per the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the Cyber-III project. As a temporary measure, administrators may consider applying manual input validation or sanitization on the $_SERVER['PHP_SELF'] variable if feasible, or restrict access to the affected functionality until a fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-06T08:14:03.365Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d3dfa80a160ebd92c701e9
Added to database: 4/6/2026, 4:30:32 PM
Last enriched: 4/6/2026, 4:47:03 PM
Last updated: 4/7/2026, 2:59:20 AM
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.