CVE-2026-5671

OVERVIEW CVE-2026-5671 is a cross-site scripting (XSS) vulnerability in the Cyber-III Student-Management-System, specifically affecting the Class Schedule Deletion Endpoint located at /admin/class%20schedule/delete_batch.php. The vulnerability stems from improper input validation of the "batch" parameter, allowing attackers to inject malicious scripts. The affected product does not use versioning; however, the vulnerability has been confirmed through commit hash 1a938fa61e9f735078e9b291d2e6215b4942af3f. SEVERITY The vulnerability carries a CVSS v3.1 score of 4.3 (MEDIUM severity) with a network attack vector requiring no privileges but user interaction. Attack complexity is low, meaning exploitation is straightforward once user engagement is achieved. The impact is limited to integrity compromise with no confidentiality or availability impact, reflecting the nature of reflected XSS attacks. The FAUCET Risk Score of 30.0/100 indicates moderate concern within the broader threat landscape. EXPLOITATION STATUS Exploit code has been publicly disclosed, increasing the practical risk of exploitation. However, the vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no active exploitation indicators. The extremely low EPSS score of 0.00035 suggests minimal real-world exploitation likelihood. The development team was notified through an issue report but has not responded, indicating a lack of active remediation efforts.