rootpwn

medium · CVSS v3 4.3 · CVSS v4 5.3 · EPSS 0.0047

CVE-2026-95957

CVE-2026-95957 is a cross‑site scripting flaw in SourceCodester Smart Attendance System with QR Code Scanner 1.0. The flaw is triggered by m

Overview

CVE-2026-95957 is a cross‑site scripting flaw in SourceCodester Smart Attendance System with QR Code Scanner 1.0. The flaw is triggered by manipulating the full_name parameter in student_signup.php, allowing remote attackers to inject malicious scripts. It can lead to session hijacking or defacement of the web interface.

Description

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file student_signup.php of the component Self-Registration. Performing a manipulation of the argument full_name results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Impact

Confidentiality: attackers can steal user session cookies or read sensitive data via injected scripts. Integrity: malicious scripts can modify page content or redirect users. Availability: not directly affected. Defenders: web admins and developers of the system.

Remediation

Apply the vendor‑supplied patch that sanitizes the full_name input, or implement server‑side validation to escape HTML characters. If no patch is available, whitelist allowed characters or use a library like OWASP ESAPI to encode output. Additionally, enable a web application firewall to block XSS payloads.

Risk context

The CVE has a medium severity score (CVSS v3 4.3) and a low EPSS of 0.0047, indicating a relatively low likelihood of exploitation in the wild, but the vulnerability remains publicly known and could be leveraged by attackers with modest skill.

Affected products

  • SourceCodester Smart Attendance System with QR Code Scanner 1.0

Scores

Severity
medium
CVSS v2
5
CVSS v3
4.3
CVSS v4
5.3
EPSS
0.0047

XSS Web Application Input Validation SourceCodester QR Code Scanner Medium Severity EPSS

← All CVEs

Related CVEs

medium

CVE-2026-84741

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

View analysis

medium

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

View analysis

medium

CVE-2026-86603

WP Recipe Maker plugin versions prior to 10.8.2 lack an authorization check on an AJAX endpoint, enabling any logged-in user to view unpublished recipe list IDs and titles. This flaw can expose sensitive content and user data. It affects sites running the vulnerable plugin.

View analysis

medium

CVE-2026-86601

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.

View analysis