CVE-2026-105808

LowCVSS 3.5/10Last modified Oct 9, 2026

Description

A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
SourceCodester	Simple Student Information System	1.0

References

Timeline

Published: Oct 6, 2026
Last modified: Oct 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1058094.3A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the fi CVE-2026-105816.3A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64_decode of the file /plus/download.php?open=1.CVE-2026-1058108.5Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated at CVE-2026-1058116.5Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://git CVE-2026-1058129.0Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow CVE-2026-1058136.3Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another loc CVE-2026-1058145.3TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protect CVE-2026-1058157.1TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The e CVE-2026-1058168.0Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin di CVE-2026-1058185.9Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificate CVE-2026-105827.4Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone.CVE-2026-1058205.4Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned