CVE-2026-95957: Smart Attendance System XSS Vulnerability

CVE-2026-95957 Overview

CVE-2026-95957 is a cross-site scripting (XSS) vulnerability in SourceCodester Smart Attendance System with QR Code Scanner 1.0. The flaw resides in the prepend function of student_signup.php, part of the Self-Registration component. Attackers can inject malicious script by manipulating the full_name parameter during student self-registration. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Remote exploitation is possible without authentication, though user interaction is required for the injected payload to execute. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse.

Critical Impact
Remote attackers can inject persistent JavaScript into the application through the self-registration form, enabling session theft, credential harvesting, and administrative account compromise when staff view attendance records.

Affected Products

SourceCodester Smart Attendance System with QR Code Scanner 1.0
Component: Self-Registration (student_signup.php)
Affected function: prepend

Discovery Timeline

2026-09-23 - CVE-2026-95957 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95957

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw located in the student self-registration workflow of the Smart Attendance System with QR Code Scanner. The prepend function within student_signup.php writes user-controlled input into the rendered page without proper output encoding. Because the application accepts self-registration from unauthenticated users, an attacker can inject a payload that later executes in the browser of any user viewing the affected data, including administrators managing student records.

Exploitation requires only network access to the registration endpoint and a single victim to view the tainted content. The public availability of exploit details lowers the barrier for opportunistic use against exposed instances.

Root Cause

The root cause is missing sanitization and contextual output encoding on the full_name parameter. The prepend function treats attacker-supplied input as trusted markup rather than as text. This aligns with [CWE-79], where user data flows into an HTML rendering context without escaping metacharacters such as <, >, and ".

Attack Vector

An unauthenticated remote attacker submits the self-registration form with a crafted full_name value containing JavaScript. The malicious payload is stored server-side and rendered whenever the value is displayed. When a legitimate user, typically an administrator reviewing registrations, loads the affected page, the injected script executes in their browser session under the application's origin. This enables session cookie theft, forced actions on behalf of the victim, and phishing overlays.

No verified proof-of-concept code has been published in a technical form. Refer to the VulDB entry for CVE-2026-95957 and the project repository for additional context.

Detection Methods for CVE-2026-95957

Indicators of Compromise

HTTP POST requests to student_signup.php containing angle brackets, <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload= in the full_name field.
Database records in the students or registration tables where the full_name column contains HTML or JavaScript markup.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing the registration or attendance pages.

Detection Strategies

Deploy web application firewall rules that inspect the full_name parameter on student_signup.php for XSS signatures and block requests containing HTML tags or script constructs.
Review historical web server access logs for prior POST requests to student_signup.php that contain URL-encoded XSS payloads (%3Cscript%3E, %3Cimg, %22onerror).
Perform database queries against stored registration data to identify existing tainted records requiring remediation.

Monitoring Recommendations

Monitor administrative user sessions for anomalous activity following visits to registration review pages, including new session creation from unexpected IP addresses.
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts on pages that render student data.
Alert on outbound HTTP requests from browser sessions to unrecognized domains sourced from application pages.

How to Mitigate CVE-2026-95957

Immediate Actions Required

Disable or restrict access to the self-registration workflow (student_signup.php) until a fix is applied, especially on internet-facing deployments.
Audit existing student records for stored XSS payloads in the full_name column and sanitize or remove affected entries.
Rotate administrator session tokens and credentials that may have been exposed while the vulnerability was reachable.

Patch Information

No official vendor patch has been published for SourceCodester Smart Attendance System with QR Code Scanner 1.0 at the time of disclosure. Monitor the project repository and the SourceCodester site for updates. Until a patch is available, apply the compensating controls described below.

Workarounds

Apply server-side input validation and output encoding on the full_name parameter using functions such as htmlspecialchars($input, ENT_QUOTES, 'UTF-8') before rendering.
Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place the application behind a web application firewall with XSS filtering enabled and restrict administrative interfaces to trusted networks or VPN access.

bash

# Example Content Security Policy header for Apache to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"