CVE-2026-4991

Received Received - Intake

Cross-Site Scripting in QDOCS Admission Enquiry Module

Publication date: 2026-03-27

Last updated on: 2026-03-27

Assigner: VulDB

Description

A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admin/enquiry of the component Admission Enquiry Module. Performing a manipulation of the argument Note results in cross site scripting. The attack is possible to be carried out remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-27

Last Modified

2026-03-27

Generated

2026-07-06

AI Q&A

2026-03-28

EPSS Evaluated

2026-07-05

NVD

CVE-2026-4991

EUVD

EUVD-2026-16897

Affected Vendors & Products

Vendor	Product	Version / Range
qdocs	smart_school_management_system	to 7.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Impact Analysis

The vulnerability allows an attacker to perform cross-site scripting attacks remotely.

This can lead to the execution of malicious scripts in the context of the affected application, potentially compromising user interactions.

While the CVSS scores indicate a low to medium severity (BaseScore 3.5 to 5.1), the impact is primarily on integrity, as it can allow injection of unauthorized scripts.

Executive Summary

This vulnerability exists in the QDOCS Smart School Management System up to version 7.2, specifically in an unknown function within the /admin/enquiry file of the Admission Enquiry Module.

It involves manipulation of the argument 'Note' which leads to a cross-site scripting (XSS) vulnerability.

An attacker can exploit this vulnerability remotely by injecting malicious scripts through the 'Note' parameter.

Hi! I’m here to help you understand CVE-2026-4991. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70