CVE-2026-104612

MediumCVSS 4.3

Published: 02/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Student Result Management System 1.0 in the Announcement Module, in the file script/academic/core/new_announcement.php, affecting the title/announcement arguments. The attack can be performed remotely, and the exploit is publicly available.

Risk Assessment

An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.

Recommendation

It is recommended to validate and sanitize input data in new_announcement.php and apply appropriate anti-XSS filters.

Other vulnerabilities in SourceCodester Student Result Management System

CVE-2026-5531Medium
Cleartext storage vulnerability in SourceCodester Student Result Management System 1.0. An unknown function in the file /login_credentials.txt of the HTTP GET Request Handler component stores credentials in cleartext. The attack can be performed remotely, exploit is public.

Original NVD description (English source)

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS