CVE-2026-5671
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Cyber-III Student-Management-System has an XSS vulnerability in the file /admin/class%20schedule/delete_batch.php. Manipulation of the batch argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.
Risk Assessment
An attacker can inject malicious script that executes in the administrator's browser, potentially leading to session theft or data modification.
Recommendation
Immediately apply patches from the vendor or temporarily disable the schedule deletion function.
Other vulnerabilities in Cyber-III Student-Management-System
See all- CVE-2026-5670Medium
In Cyber-III Student-Management-System, the move_uploaded_file function in /AssignmentSection/submission/upload.php allows unrestricted file upload via manipulation of the File argument. The attack can be initiated remotely and a public exploit is already available.
- CVE-2026-5668Low
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used.
- CVE-2026-5643Low
A cross-site scripting vulnerability was identified in Cyber-III Student-Management-System in the file /admin/Add%20notice/notice.php due to improper handling of the $_SERVER['PHP_SELF'] argument. The attack can be launched remotely and a public exploit is already available. The vendor has not responded to the report.
Original NVD description (English source)
A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Impacted is an unknown function of the file /admin/class%20schedule/delete_batch.php of the component Class Schedule Deletion Endpoint. Executing a manipulation of the argument batch can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS