CVE-2023-1771

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as problematic. Affected by this issue is the function get_scale of the file Master.php. The manipulation of the argument perc leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224672.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Grade Point Average GPA Calculator	1.0

References

https://github.com/E1CHO/cve_hub/blob/main/Grade%20Point%20Average%20(GPA)%20Calculator%20in%20PHP%20and%20SQLite3/Grade%20Point%20Average%20(GPA)%20Calculator%20in%20PHP%20and%20SQLite3%20vlun%201.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.224672Permissions Required, Third Party Advisory
https://vuldb.com/?id.224672Third Party Advisory
https://github.com/E1CHO/cve_hub/blob/main/Grade%20Point%20Average%20(GPA)%20Calculator%20in%20PHP%20and%20SQLite3/Grade%20Point%20Average%20(GPA)%20Calculator%20in%20PHP%20and%20SQLite3%20vlun%201.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.224672Permissions Required, Third Party Advisory
https://vuldb.com/?id.224672Third Party Advisory

Timeline

Published: Mar 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-17724.8A vulnerability was found in DataGear up to 4.5.1. It has been classified as problematic. This affects an unknown part of the component Diag CVE-2023-17739.8A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConf CVE-2023-17745.4When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allow CVE-2023-17756.5When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast t CVE-2023-17765.4Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to CVE-2023-17775.3Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosin CVE-2023-17789.8This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default creden CVE-2023-17794.3Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX2 CVE-2023-17806.1The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pa CVE-2023-17829.8HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for cluste CVE-2023-17837.6OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application CVE-2023-17849.8A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Do