CVE-2025-64070
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field. User-supplied input is not properly sanitized.
Risk Assessment
An attacker can inject malicious JavaScript that executes in other users' browsers, enabling session theft or content manipulation.
Recommendation
Implement input validation and encoding for the Add New Subject Description field and apply Content-Security-Policy headers. Update the application to a patched version.
Other vulnerabilities in Sourcecodester Student Grades Management System
See all- CVE-2026-9486Medium
A CSRF vulnerability has been discovered in SourceCodester Student Grades Management System 1.0. An unknown part allows CSRF attacks that can be executed remotely. The exploit has been made public and may be used in attacks.
- CVE-2026-9485Low
A cross-site scripting vulnerability was found in SourceCodester Student Grades Management System 1.0 in the students.php file via the Remarks argument. Remote attack is possible. Exploit is publicly available.
- CVE-2025-63892Medium
A stored cross-site scripting vulnerability was found in SourceCodester Student Grades Management System 1.0. The create_classroom function in /classroom.php fails to sanitize the name/description arguments, allowing script injection.
- CVE-2025-12332Low
A flaw has been found in SourceCodester Student Grades Management System 1.0 in the delete_user function of /admin.php. Manipulation leads to cross site scripting. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS