CVE-2026-12176: SourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting

Published Jun 13, 2026

Updated

A vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The impacted element is an unknown function of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Affected Software

1 affected component

Sourcecodester CET Automated Grading System with AI Predictive Analytics=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 from your environment.
Uninstall or take the affected application offline if it is not required or if a timely secure code fix cannot be applied.
Configuration
In /index.php, validate and sanitize the 'action' argument and apply proper output encoding (HTML encode/escape) before rendering to prevent cross-site scripting.
/index.php (action parameter) action parameter input handling = validate, sanitize and HTML-encode user-supplied input
Compensating control
If an immediate code fix is not available, restrict access to the application to trusted/internal IPs and/or deploy a web application firewall (WAF) rule to block XSS payloads targeting the 'action' parameter.
Operational
Monitor web server and application logs for attempts to exploit the 'action' parameter and investigate any suspected successful exploitation; follow incident response procedures if compromise is suspected.

Event History

Jun 13, 2026

CVE Published

via MITRE·11:15 PM

Data Sourced

via MITRE·11:15 PM

DescriptionSeverityWeakness

Jun 14, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeakness

May 5, 58420

Event

via NVD·10:13 AM

Frequently Asked Questions

What is the severity of CVE-2026-12176?

The severity of CVE-2026-12176 is classified as medium with a score of 4.3.

What type of vulnerability is CVE-2026-12176?

CVE-2026-12176 is a cross-site scripting (XSS) vulnerability.

How can I mitigate CVE-2026-12176?

Mitigation for CVE-2026-12176 involves sanitizing user inputs in the affected function to prevent malicious script execution.

Can CVE-2026-12176 be exploited remotely?

Yes, CVE-2026-12176 can be exploited remotely by manipulating the 'action' parameter.

What software is affected by CVE-2026-12176?

The affected software is SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0.