CVE-2026-97650

Publié : 25 septembre 2026

Modifié : 25 septembre 2026

Score CVSS

4.3

MEDIUM

Description détaillée

A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Références et Patchs

https://github.com/ningzichun/student-management-system/https://github.com/ningzichun/student-management-system/issues/11 https://vuldb.com/cve/CVE-2026-97650 https://vuldb.com/submit/910059 https://vuldb.com/vuln/409752 https://vuldb.com/vuln/409752/cti

Dernières Vulnérabilités

CVE-2026-97736

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

VOIR DÉTAILS

CVE-2026-97735

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

VOIR DÉTAILS

CVE-2026-97732

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

VOIR DÉTAILS