CVE-2026-86226: Cross Site Scripting in Projectwolds Online Attendance System

This vulnerability involves a cross-site scripting issue in the Projectwolds Online Attendance System 1.0, specifically in the profile.php file. An attacker can manipulate the email parameter to inject malicious scripts, potentially leading to script execution in the context of the victim's browser. The attack vector is network-based, requires low attack complexity, and low privileges but does require user interaction. The vulnerability has been publicly disclosed, and exploit code is available, though no active exploitation in the wild is confirmed.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited by the requirement for user interaction and low privileges, and there is no indication of server-side compromise or data breach from the provided information.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the email parameter if possible.