{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aoretnom23school_fees_management_system1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:oretnom23:school_fees_management_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.4,"id":"CVE-2023-49987"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["School Fees Management System (1.0)"],"_cs_severities":["low"],"_cs_tags":["xss","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["oretnom23"],"content_html":"\u003cp\u003eA stored cross-site scripting (XSS) vulnerability exists in the School Fees Management System version 1.0. An authenticated attacker with administrative access can inject arbitrary web scripts through the tname parameter within the /management/term component. Successful exploitation requires an authenticated user with administrative privileges to interact with the vulnerable form to save the payload, which is subsequently executed in the context of the user viewing the term management page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking, unauthorized actions performed on behalf of the administrator, or unauthorized access to sensitive system data managed by the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit logs for the specified endpoint (/management/term) to identify potential injection of script tags.\u003c/li\u003e\n\u003cli\u003eImplement input validation and output encoding for the tname parameter within the School Fees Management System to prevent script injection.\u003c/li\u003e\n\u003cli\u003eAs version 1.0 appears to be the only version listed, evaluate the use of this software within the environment given the lack of identified security updates.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T04:13:38Z","date_published":"2026-10-27T04:13:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-school-fees-xss/","summary":"The School Fees Management System version 1.0 is vulnerable to stored cross-site scripting (XSS) via the tname parameter in the new_term administrative component.","title":"oretnom23 School Fees Management System: Stored XSS in tname parameter (CVE-2023-49987)","url":"https://feed.craftedsignal.io/briefs/2026-10-school-fees-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:oretnom23:school_fees_management_system:1.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}