CVE-2026-5643
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A cross-site scripting vulnerability was identified in Cyber-III Student-Management-System in the file /admin/Add%20notice/notice.php due to improper handling of the $_SERVER['PHP_SELF'] argument. The attack can be launched remotely and a public exploit is already available. The vendor has not responded to the report.
Risk Assessment
An attacker could execute malicious script in an administrator's browser, hijack sessions, or perform actions on their behalf. Since the exploit is public, the likelihood of exploitation is high.
Recommendation
Validate and encode input for the $_SERVER['PHP_SELF'] parameter and deploy Content-Security-Policy headers. Until a fix is released, consider restricting access to the administrative panel.
Other vulnerabilities in Cyber-III Student-Management-System
See all- CVE-2026-5671Medium
The Cyber-III Student-Management-System has an XSS vulnerability in the file /admin/class%20schedule/delete_batch.php. Manipulation of the batch argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-5670Medium
In Cyber-III Student-Management-System, the move_uploaded_file function in /AssignmentSection/submission/upload.php allows unrestricted file upload via manipulation of the File argument. The attack can be initiated remotely and a public exploit is already available.
- CVE-2026-5668Low
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability was identified in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This impacts an unknown function of the file /admin/Add%20notice/notice.php of the component Admin Add Endpoint. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS