CVE-2026-97650: ningzichun student-management-system addLog.php echo cross site scripting
A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What input is vulnerable, and what access does an attacker need?
The vulnerable inputs are the reason and detail arguments processed by admin/fun/addLog.php. The attack can be initiated remotely and does not require privileges, though it requires a user to interact with the crafted content.
Which releases are affected?
The issue affects ningzichun student-management-system through commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. No fixed version or remediation commit is provided.
Is public exploit activity a concern?
Yes. Exploit details have been publicly disclosed and may be used, increasing the likelihood of attempted exploitation.
What can be done while no vendor fix is available?
No specific workaround is provided. Prioritize reviewing and restricting exposure to the affected admin/fun/addLog.php functionality and ensure untrusted reason and detail values are not rendered as executable browser content.