Home

Description

EN DE

A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function add_user of the file /admin.php of the component Manage Users Page. This manipulation of the argument first_name/last_name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

In SourceCodester Student Grades Management System 1.0 wurde eine Schwachstelle gefunden. Dies betrifft die Funktion add_user der Datei /admin.php der Komponente Manage Users Page. Mit der Manipulation des Arguments first_name/last_name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden.

PUBLISHED Reserved 2025-10-08 | Published 2025-10-08 | Updated 2025-10-08 | Assigner VulDB




MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
LOW: 2.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
LOW: 2.4CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
3.3AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR

Problem types

Cross Site Scripting

Code Injection

Product status

1.0
affected

Timeline

2025-10-08:Advisory disclosed
2025-10-08:VulDB entry created
2025-10-08:VulDB entry last update

Credits

sidzeroday (VulDB User) reporter

References

vuldb.com/?id.327602 (VDB-327602 | SourceCodester Student Grades Management System Manage Users admin.php add_user cross site scripting) vdb-entry technical-description

vuldb.com/?ctiid.327602 (VDB-327602 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.667406 (Submit #667406 | sourcecodester Student Grades Management System 1.0 Improper Input Validation) third-party-advisory

github.com/sidzeroday/sourcecodester_cve/blob/main/README.md exploit

www.sourcecodester.com/ product

cve.org (CVE-2025-11485)

nvd.nist.gov (CVE-2025-11485)

Download JSON