CVE-2026-5671 Details

A reflected cross-site scripting vulnerability has been identified in the Cyber-III Student-Management-System in the class schedule deletion endpoint located at '/admin/class schedule/delete_batch.php'. This issue arises from the absence of proper administrator permission checks, allowing unauthorized access to the endpoint. Additionally, the 'batch' parameter in POST requests is not properly sanitized before being included in the HTML response, enabling the injection of malicious scripts that are executed in the context of the user's browser.

It is recommended to add proper authentication and authorization checks to ensure that only users with administrative privileges can access the deletion endpoint. Additionally, output should be escaped using 'htmlspecialchars()' to prevent cross-site scripting.