CVE-2026-37750

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-28 · updated 2026-07-20
Weakness: CWE-79

Description

A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim's browsers via the unsanitized type parameter in register.php.

References

https://github.com/mahmoudai1/school-management-system
https://github.com/mahmoudai1/school-management-system/blob/main/register.php
https://github.com/menevarad007/CVE-2026-37750
https://github.com/menevarad007/CVE-2026-37750

Get alerted when CVE-2026-37750 or the next vulnerability affects your stack