Executive Summary

The ProjectsAndPrograms school-management-system is vulnerable to Stored Cross-Site Scripting (XSS) in multiple attributes of students and teachers objects.

An authorized attacker, such as a teacher or administrator, can inject malicious JavaScript code that will be stored and later executed in other users' browsers.

Additionally, if this vulnerability is combined with CVE-2025-11661, which allows unauthenticated access to backend endpoints, a remote attacker without any privileges can exploit this to inject and execute arbitrary JavaScript.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute malicious JavaScript in the browsers of other users, potentially leading to session hijacking, data theft, or unauthorized actions performed on behalf of the victim.

If combined with another vulnerability (CVE-2025-11661), even remote attackers without any privileges can exploit this, increasing the risk and impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the Stored Cross-Site Scripting (XSS) vulnerability in the ProjectsAndPrograms school-management-system, immediate steps include restricting or reviewing the privileges of authorized users such as teachers and administrators who can inject malicious JavaScript.

Additionally, since this vulnerability can be chained with CVE-2025-11661 to allow remote exploitation without privileges, it is important to secure backend endpoints to prevent unauthenticated access.

Monitoring and sanitizing inputs in multiple attributes of students and teachers objects to prevent injection of malicious scripts is recommended.

Finally, coordinate with the software maintainers for patches or updates, and consider restricting user input or applying web application firewalls to block malicious payloads.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authorized attacker to inject malicious JavaScript that executes in other users' browsers, potentially leading to unauthorized access or data exposure. When combined with another vulnerability (CVE-2025-11661), it can be exploited remotely without privileges. Such security weaknesses can lead to breaches of personal data confidentiality and integrity, which may violate common standards and regulations like GDPR and HIPAA that require protection of personal and sensitive information.

Specifically, the risk of unauthorized script execution and potential data leakage could result in non-compliance with data protection requirements, including ensuring appropriate technical safeguards against unauthorized access and maintaining data security.

Useful 0 Not Useful 0