Stored Cross-Site Scripting Vulnerability in Sourcecodester School Task Manager
CVE-2024-28277
6.1MEDIUM
Summary
A security vulnerability exists in Sourcecodester's School Task Manager version 1.0 that allows for Stored Cross-Site Scripting (XSS) attacks through the subject_name parameter. This flaw enables attackers to insert and store malicious JavaScript payloads by manipulating the subject name. When users render this data, the executed scripts can lead to unauthorized actions, data theft, and potential compromise of user accounts. Immediate remediation is necessary to mitigate any risk of exploitation.
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published