CVE-2026-104612: SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting
A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/newannouncement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vulnerable announcement endpoint can be reached remotely, and no privileges are required according to the CVSS vector. Exploitation does require user interaction, meaning someone must view or otherwise process the crafted announcement content.
Which inputs are affected?
The issue is associated with the title and announcement arguments handled by script/academic/core/new_announcement.php in the Announcement Module. Manipulating either input can result in cross-site scripting.
How urgent is remediation?
The issue is rated medium severity with a 4.3 CVSS score, but public exploit information is available and the exploit could be used. Prioritize review of exposed Student Result Management System 1.0 deployments and announcement functionality.