CVE-2021-28424

A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or HTML via the 'email' POST parameter in adminprofile.php.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.31% chance of exploitation in the next 30 days, 69th percentile

Published

2021-07-01

Updated

2024-08-03

Proof-of-concept exploits (3)

• https://nhattruong.blog/2021/05/22/cve-2021-28424-teachers-record-management-system-1-0-e…
• https://packetstormsecurity.com/files/163171/Teachers-Record-Management-System-1.0-Cross-…
• https://www.exploit-db.com/exploits/50019

References

• CVE Record
• NVD entry

Related

• CVE-2021-28423
• CVE-2021-28447
• CVE-2021-28420
• CVE-2021-28459
• CVE-2021-28419
• CVE-2021-28476