CVE-2026-95957: SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can exploit it remotely by submitting a crafted full_name value through the self-registration functionality. No privileges are required, but exploitation requires user interaction.
Are systems running the affected release exposed by default?
The issue is in the Self-Registration component's student_signup.php endpoint. Deployments where users can access and use self-registration are exposed to the affected full_name input handling.
How urgent is remediation?
Public exploit information is available, which increases the likelihood of attempted exploitation. Prioritize remediation or restrict access to the self-registration function while a fix is unavailable.