Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-104612: SourceCodester Student Result Management System allows malicious scripts in announcements
CVE-2026-104612 · published 17 days ago
Summary
The announcement feature in the SourceCodester Student Result Management System lets an attacker add harmful code to the title of a new announcement. When other users view the announcement, the malicious code runs in their browsers, potentially stealing data or taking other unwanted actions. Apply any available updates, ensure input is properly cleaned, and consider adding content filtering to stop scripts from being saved.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sourcecodester | student result management system | 1.0 |
Original advisory text
SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting
A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Track software like this
Free during beta