CVE-2026-86268

The ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker can inject malicious JavaScript that is subsequently executed in other users’ browsers. When chained with CVE‑2025‑11661, it can be exploited remotely without privileges.

A reflected Cross-Site Scripting (XSS) vulnerability was found in the School Management System by mahmoudai1. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser via the unsanitized type parameter in register.php.

In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter. The vulnerability allows reflection of malicious script in the server response.

An XSS vulnerability in School Management System (rolling release) exists in /student-view.php in the Edit Student Info Page component. Manipulation of the First Name argument causes XSS. Remote attack is possible, exploit is public.

School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php. An attacker can inject malicious JavaScript that executes in the user's browser.

ProjectsAndPrograms School Management System 1.0 has an SQL injection vulnerability in owner_panel/fetch-data/select-students.php. Manipulating the select argument allows remote attacks. The exploit has been published.