CVE-2026-7222 Details

A stored cross-site scripting vulnerability has been identified in Code-Projects Coaching Management System version 1.0. The issue resides in the complaint form page, specifically within the file '/cims/modules/student/complaint.php'. This vulnerability allows low-privileged users, such as students, to inject malicious JavaScript that is stored and executed when the complaint is viewed by higher-privileged users, like administrators or teachers. Additionally, the reply functionality is also vulnerable, enabling cross-role exploitation. The lack of proper input sanitization and output encoding, combined with missing security controls on session cookies, facilitates this vulnerability, leading to session hijacking and unauthorized access to administrative accounts.

It is recommended to sanitize and validate all user inputs, encode outputs using appropriate functions such as htmlspecialchars() in PHP, and set the HttpOnly and Secure flags on session cookies. Implementing a Content Security Policy (CSP) is also advised.