CVE-2026-37750

MediumCVSS 6.1/10Last modified Jul 20, 2026

Description

A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim's browsers via the unsanitized type parameter in register.php.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2026
Last modified: Jul 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-377519.8An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attac CVE-2026-37765.5The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF cont CVE-2026-37777.8The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document z CVE-2026-37785.5The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations a CVE-2026-37797.8The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which CVE-2026-37807.8The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can inc CVE-2026-37815.4The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and includi CVE-2026-37835.3When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that tok CVE-2026-37846.5curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for CVE-2026-37858.8A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of th CVE-2026-37868.8A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php CVE-2026-37877.0A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the componen