CVE-2026-86226: Projectwolds Online Attendance System profile.php cross site scripting
A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access and interaction prerequisites are indicated for exploitation?
The CVSS vector indicates that an attacker needs low-level privileges and requires user interaction. The attack vector is network-based, so exploitation can be initiated remotely.
What is the expected security impact if exploitation succeeds?
The CVSS assessment indicates no confidentiality impact and no availability impact. It indicates a low integrity impact, meaning an attacker may be able to cause limited unauthorized modification through the affected functionality.