Stored Cross-Site Scripting Vulnerability in Sourcecodester School Task Manager

CVE-2024-28277

What is CVE-2024-28277?

A security vulnerability exists in Sourcecodester's School Task Manager version 1.0 that allows for Stored Cross-Site Scripting (XSS) attacks through the subject_name parameter. This flaw enables attackers to insert and store malicious JavaScript payloads by manipulating the subject name. When users render this data, the executed scripts can lead to unauthorized actions, data theft, and potential compromise of user accounts. Immediate remediation is necessary to mitigate any risk of exploitation.

References