CVE-2025-9306

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice/addNotice. The manipulation of the argument noticeSubject results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
SourceCodester	Advanced School Management System	1.0

References

https://github.com/lrjbsyh/CVE_Hunter/issues/3Exploit, Issue Tracking, Third Party Advisory
https://github.com/lrjbsyh/CVE_Hunter/issues/3#issue-3313419319Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.320911Permissions Required, VDB Entry
https://vuldb.com/?id.320911Third Party Advisory, VDB Entry
https://vuldb.com/?submit.632419Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Aug 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-93079.8A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This ma CVE-2025-93085.5A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. CVE-2025-93097.0A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Ha CVE-2025-93107.5A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unkn CVE-2025-93119.8A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2025-93129.8A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services CVE-2025-93139.3An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the data CVE-2025-93149.8The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload CVE-2025-93156.3An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attribut CVE-2025-93166.9N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.CVE-2025-93178.4The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse eng CVE-2025-93186.5The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_lin