CVE-2026-105809

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Student Information System version 1.0

Description An issue exists in the Profile Field Handler component within the '/register.php' endpoint. Remote attackers can trigger cross site scripting (XSS)—a technique used to inject malicious scripts into web pages viewed by other users—by manipulating the firstname and lastname variables.

Recommendations Update SourceCodester Simple Student Information System version 1.0 to a patched version. As a temporary mitigation, restrict access to the '/register.php' endpoint or sanitize the firstname and lastname inputs.