CVE-2026-5643
Remote XSS in Cyber-III Admin Add Endpoint Notice.php
Publication date: 2026-04-06
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cyber-iii | student-management-system | to 1a938fa61e9f735078e9b291d2e6215b4942af3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5643 is a reflected Cross-Site Scripting (XSS) vulnerability in the Cyber-III Student-Management-System, specifically in the file /admin/Add notice/notice.php. The vulnerability occurs because the script uses the unsanitized $_SERVER['PHP_SELF'] variable directly as the form's action attribute. This allows an attacker to craft a malicious URL that injects arbitrary JavaScript code, which is then executed by the victim's browser.
An attacker can exploit this by logging into the admin panel with preset credentials and accessing a specially crafted URL that causes the browser to execute the injected script. This can lead to actions such as displaying alert boxes or more harmful scripts that steal cookies, perform phishing, or hijack the admin session.
The recommended fix is to avoid directly outputting user-controllable input in the form action attribute. Instead, use a hardcoded relative URL or properly sanitize the output using PHP’s htmlspecialchars() function to prevent script injection.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute arbitrary JavaScript code in the context of the admin panel. This can lead to theft of cookies, phishing attacks, or hijacking of the admin session, potentially giving attackers unauthorized access or control over the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the vulnerable endpoint with a specially crafted URL that injects JavaScript code via the PHP_SELF variable. For example, accessing a URL like the following can reveal if the system is vulnerable by triggering a script execution alert in the browser:
- http://127.0.0.1:3000/admin/Add%20notice/notice.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
If the alert box with the text "XSS" appears, it confirms the presence of the reflected cross-site scripting vulnerability.
No specific network commands are provided, but manual testing via browser or automated scanning tools targeting reflected XSS on the /admin/Add notice/notice.php endpoint with manipulation of the PHP_SELF parameter can be used.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves modifying the vulnerable code to avoid directly outputting the unsanitized $_SERVER['PHP_SELF'] variable in the form's action attribute.
- Replace the dynamic PHP_SELF usage with a hardcoded relative URL such as an empty string "" or "notice.php" to post to the same page safely.
- If dynamic values are necessary, properly sanitize the output using PHP's htmlspecialchars() function with appropriate flags, for example: <?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?>
These steps prevent script injection by encoding special characters, thereby mitigating the cross-site scripting vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a reflected Cross-Site Scripting (XSS) issue in the Cyber-III Student-Management-System that allows execution of arbitrary JavaScript in the admin panel.
Such XSS vulnerabilities can lead to session hijacking, phishing, or theft of sensitive information, which may result in unauthorized access to personal or protected data.
This unauthorized access or exposure of sensitive data could potentially violate compliance requirements under standards like GDPR or HIPAA, which mandate protection of personal and health information.
However, the provided information does not explicitly state the impact on compliance or whether any personal data is affected.