School Fees Management System (1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/school-fees-management-system-1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 04:13:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgoretnom23 School Fees Management System: Stored XSS in tname parameter (CVE-2023-49987)https://feed.craftedsignal.io/briefs/2026-10-school-fees-xss/Tue, 27 Oct 2026 04:13:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-school-fees-xss/The School Fees Management System version 1.0 is vulnerable to stored cross-site scripting (XSS) via the tname parameter in the new_term administrative component.A stored cross-site scripting (XSS) vulnerability exists in the School Fees Management System version 1.0. An authenticated attacker with administrative access can inject arbitrary web scripts through the tname parameter within the /management/term component. Successful exploitation requires an authenticated user with administrative privileges to interact with the vulnerable form to save the payload, which is subsequently executed in the context of the user viewing the term management page.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking, unauthorized actions performed on behalf of the administrator, or unauthorized access to sensitive system data managed by the application.

Recommendation

  • Audit logs for the specified endpoint (/management/term) to identify potential injection of script tags.
  • Implement input validation and output encoding for the tname parameter within the School Fees Management System to prevent script injection.
  • As version 1.0 appears to be the only version listed, evaluate the use of this software within the environment given the lack of identified security updates.
]]>lowadvisoryxssweb-vulnerability