ProjectsAndPrograms School Management System Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the ProjectsAndPrograms school-management-system. This issue allows authorized users, such as teachers or administrators, to inject malicious JavaScript into various attributes of student and teacher objects. The injected script is executed in the browsers of other users. Notably, when this vulnerability is combined with CVE-2025-11661, which provides unauthenticated access to backend endpoints, it can be exploited by remote attackers without any privileges to inject and execute arbitrary JavaScript.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected data.