CVE-2026-2156: code-projects Online Student Management System Announcement Management index.php cross site scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-08 · updated 2026-06-17
Weakness: CWE-79

Description

A weakness has been identified in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the file /admin/announcement/index.php?view=add of the component Announcement Management Module. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Affected products

code-projects Online Student Management System: 1.0

References

https://code-projects.org/
https://github.com/baguette168/CVE/issues/1
https://vuldb.com/?ctiid.344858
https://vuldb.com/?id.344858
https://vuldb.com/?submit.748328

Get alerted when CVE-2026-2156 or the next vulnerability affects your stack