Executive Summary

CVE-2026-10112 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Admin, Student, and Teacher Dashboards of the STUDENT-MANAGEMENT-SYSTEM. It occurs because user details, such as names, are directly inserted into HTML attributes without proper encoding. This allows an attacker to inject malicious JavaScript code into user fields, which then executes in the browsers of other users who view the affected dashboards.

For example, an attacker could insert a payload like "><script>alert(document.cookie)</script> into a student's name field. When an administrator or other user accesses the dashboard, the injected script runs, potentially stealing sensitive information or performing unauthorized actions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized execution of malicious scripts in the browsers of users who access the affected dashboards. This can result in theft of sensitive data such as cookies, session tokens, or other personal information.

Additionally, attackers may perform unauthorized actions on behalf of the victim users, potentially compromising the integrity and security of the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of malicious JavaScript payloads injected into user input fields, such as the Name field, in the Dashboard pages of the STUDENT-MANAGEMENT-SYSTEM.

One way to detect it is to query the database for suspicious entries containing script tags or other HTML/JavaScript code in user-related fields.

• Use SQL queries to search for script tags in the Name field, for example: SELECT * FROM users WHERE name LIKE '%<script>%';
• Monitor HTTP traffic to the Dashboard pages for unexpected script execution or injected payloads.
• Use web vulnerability scanners that detect stored XSS vulnerabilities by injecting test payloads into input fields and observing their execution.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing and encoding user input before storing or rendering it in the Dashboard pages to prevent execution of injected scripts.

Specifically, apply proper HTML entity encoding to user-supplied data when displaying it in HTML attributes.

Additionally, review and restrict permissions to limit who can insert or modify user data to reduce the risk of unauthorized injection.

If possible, remove or sanitize any existing malicious entries in the database.

Monitor for suspicious activity and consider applying web application firewall (WAF) rules to block common XSS attack patterns.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw that allows attackers to inject malicious scripts into user fields such as names, which execute when viewed by others. This can lead to unauthorized access to sensitive information, such as session cookies, potentially compromising user data.

Such unauthorized access and potential data leakage can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized disclosure or access.

However, the provided information does not explicitly state the impact on compliance with these standards.

Useful 0 Not Useful 0