CVE-2026-9518 Details
Description
A vulnerability was identified in hemant6488 CodeIgniter-StudentManagementSystem. The impacted element is the function addStudent of the file view_students.php of the component Students Controller. The manipulation of the argument Name leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
A stored cross-site scripting vulnerability has been identified in the CodeIgniter Student Management System, specifically within the Students Controller's addStudent function in the view_students.php file. The issue arises because user-supplied data, particularly the 'name' parameter, is not properly sanitized before being saved to the database. This unfiltered data is then rendered directly in the view without HTML entity encoding, allowing attackers to inject and execute arbitrary JavaScript. The vulnerability can be exploited remotely, and the injected scripts are executed when users access the student listing page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hemant6488/CodeIgniter-StudentManagementSystem/ | [email protected] | ProductVendor |
| https://github.com/hemant6488/CodeIgniter-StudentManagementSystem/issues/6 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/814279 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365538 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/365538/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hemant6488 CodeIgniter-StudentManagementSystem | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |