CVE-2026-28405

CVE-2026-28405 describes a cross-site scripting (XSS) vulnerability in MarkUs, a web application for student assignment submission and grading, affecting versions prior to 2.9.1. The vulnerability allows an attacker to inject malicious scripts into the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content route due to unsanitized rendering of student-submitted files. This flaw carries a high severity CVSS score of 8.0, indicating that a low-privileged attacker can exploit it over the network with user interaction, potentially leading to high impacts on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, though it has garnered minimal community discussion.