CVE-2026-37750 Details

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in School Management System version 1.0, developed by mahmoudai1. This vulnerability allows unauthenticated remote attackers to execute arbitrary JavaScript in the browsers of victims. The issue arises from the unsanitized 'type' parameter in 'register.php', which is reflected without proper escaping. Exploitation of this vulnerability could lead to session hijacking, phishing, or malware distribution.

To address this vulnerability, sanitize the 'type' parameter by using 'htmlspecialchars' before outputting it. This can be done by replacing the current echo statements in 'register.php' with 'echo htmlspecialchars(ucfirst($_REQUEST['type']), ENT_QUOTES, 'UTF-8');' for line 22 and 'echo htmlspecialchars($_REQUEST['type'], ENT_QUOTES, 'UTF-8');' for line 26.