CVE-2025-4470

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add-student.php. The manipulation of the argument Fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
SourceCodester	Online Student Clearance System	1.0

References

https://github.com/Colorado-all/cve/blob/main/Online%20Student%20Clearance%20System/xss-2.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.308089Permissions Required, VDB Entry
https://vuldb.com/?id.308089Third Party Advisory, VDB Entry
https://vuldb.com/?submit.566249Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: May 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-44717.8A vulnerability, which was classified as critical, has been found in code-projects Jewelery Store Management system 1.0. Affected by this is CVE-2025-44727.8A vulnerability was found in code-projects Departmental Store Management System 1.0. It has been classified as critical. Affected is the fun CVE-2025-44738.8The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() fu CVE-2025-44748.8The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting CVE-2025-44764.3A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client r CVE-2025-44777.2The ThreatSonar Anti-Ransomware from TeamT5 has a Privilege Escalation vulnerability, allowing remote attackers with intermediate privileges CVE-2025-447796.6An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.CVE-2025-44786.5A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. Th CVE-2025-44795.4The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image compar CVE-2025-44807.8A vulnerability was found in code-projects Simple College Management System 1.0. It has been declared as critical. This vulnerability affect CVE-2025-44819.8A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some CVE-2025-44829.8A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0. Affected by this vulnerability is