CVE-2026-15492: Wizgrade Student Portal XSS Vulnerability

CVE-2026-15492 Overview

CVE-2026-15492 is a reflected cross-site scripting (XSS) vulnerability in the igweze wizgrade application. The flaw affects code within the dashboard/studentConductManager.php file and allows remote attackers to inject arbitrary script into the browser context of a victim user. The vendor operates a rolling release model, and the last known affected commit is b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. The vendor was contacted before public disclosure but did not respond. The exploit has been disclosed publicly.

Critical Impact
Remote attackers can inject arbitrary JavaScript into dashboard/studentConductManager.php, enabling session theft, credential capture, or unauthorized actions in the authenticated user's browser context.

Affected Products

igweze wizgrade up to commit b1d55f22b90cd7e7a6e5002f006d7c649e8086d6
Rolling release builds prior to the fixing commit
Deployments exposing dashboard/studentConductManager.php to untrusted input

Discovery Timeline

2026-07-12 - CVE-2026-15492 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15492

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw [CWE-79] located in the dashboard/studentConductManager.php component of igweze wizgrade. Attacker-controlled input reaches an HTML rendering context without adequate sanitization or output encoding. When a target user loads a crafted request, the browser executes injected JavaScript in the origin of the wizgrade application.

Successful exploitation lets an attacker run script in the victim's session. Consequences include session cookie theft, unauthorized changes to student conduct records, phishing overlays, and browser-based pivoting into internal resources. The exploit is publicly disclosed, which lowers the barrier for opportunistic attackers to weaponize it.

Root Cause

The root cause is missing or incomplete input validation and output encoding in dashboard/studentConductManager.php. User-supplied data is rendered into the response HTML without being escaped for the HTML, attribute, or JavaScript context in which it appears. Because the project uses a rolling release, no versioned fix identifier is published.

Attack Vector

The attack is remote and requires user interaction. An attacker crafts a URL or form submission containing a malicious payload targeting the vulnerable parameter in dashboard/studentConductManager.php. The attacker delivers the link through phishing, chat, or a third-party site. When an authenticated wizgrade user follows the link, the injected script executes in their session context.

No authentication is required to craft the payload, but a victim must load the malicious request for the script to fire. Impact is limited to integrity of the rendered page and any actions accessible to the victim's session.

Detection Methods for CVE-2026-15492

Indicators of Compromise

Web server access log entries targeting dashboard/studentConductManager.php containing <script, onerror=, onload=, javascript:, or URL-encoded equivalents such as %3Cscript.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after loading wizgrade dashboard pages.
Referer headers pointing to external phishing infrastructure when users reach studentConductManager.php.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects query and body parameters sent to dashboard/studentConductManager.php for XSS signatures.
Enable server-side logging of all parameters submitted to the affected endpoint and alert on payloads matching HTML tag or event handler patterns.
Correlate authenticated session activity with anomalous JavaScript-triggered requests such as unexpected fetch or XMLHttpRequest calls to non-wizgrade origins.

Monitoring Recommendations

Monitor Content Security Policy (CSP) violation reports for inline script or unauthorized script sources originating from wizgrade dashboard pages.
Alert on repeated 200-response requests to studentConductManager.php from a single source containing suspicious parameter values.
Track admin and staff session behavior for privileged operations initiated shortly after visiting externally referred URLs.

How to Mitigate CVE-2026-15492

Immediate Actions Required

Update igweze wizgrade to a commit later than b1d55f22b90cd7e7a6e5002f006d7c649e8086d6 once the maintainer publishes a fix, or apply a local patch that encodes output in dashboard/studentConductManager.php.
Restrict access to the wizgrade dashboard to trusted networks or authenticated users through reverse proxy access controls.
Deploy a WAF rule that blocks XSS payloads submitted to dashboard/studentConductManager.php.

Patch Information

The vendor uses a rolling release system and has not published version information for a fixed release. At the time of disclosure, the vendor did not respond to outreach. Track the CVE-2026-15492 Vulnerability Overview and the VulDB #377799 Details entry for updates on remediation commits. Operators self-hosting wizgrade should audit dashboard/studentConductManager.php and apply output encoding using PHP's htmlspecialchars($input, ENT_QUOTES | ENT_HTML5, 'UTF-8') on all user-controlled values before rendering.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to limit theft impact from injected scripts.
Educate users to avoid clicking untrusted links pointing to the wizgrade dashboard until a fix is deployed.

bash

# Example NGINX reverse proxy configuration to enforce CSP and cookie hardening
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
proxy_cookie_path / "/; HTTPOnly; Secure; SameSite=Strict";