CVE-2026-3982

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_result.php. Executing a manipulation of the argument vr can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-398207.5Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocatiCVE-2026-398219.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xCVE-2026-398227.8On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of CVE-2026-398236.1CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL conteCVE-2026-398243.3NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeStriCVE-2026-398255.3ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director fuCVE-2026-398266.1If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespacCVE-2026-398276.5An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually craCVE-2026-398286.3When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded,CVE-2026-398297.5The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or CVE-2026-39833.5A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown partCVE-2026-398309.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The bl
CVE-2026-3982: Medium severity, CVSS 4.3 | Vulnix