CVE-2026-105809

MediumCVSS 4.3/10Last modified Oct 6, 2026

Description

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Oct 6, 2026
Last modified
Oct 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-105816.3A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64_decode of the file /plus/download.php?open=1.CVE-2026-1058108.5Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated atCVE-2026-1058116.5Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://gitCVE-2026-1058129.0Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow CVE-2026-1058145.3TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protectCVE-2026-1058157.1TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The eCVE-2026-1058168.0Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin diCVE-2026-1058185.9Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificateCVE-2026-105827.4Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone.CVE-2026-1058205.4Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned CVE-2026-1058286.3Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validatiCVE-2026-1058296.1League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the Di