CVE-2025-27584

Name of the Vulnerable Software and Affected Versions Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118

Description A stored cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the First Name parameter at the "/rest/staffResource/update" API endpoint.

Recommendations For version 1.0.118, as a temporary workaround, consider restricting access to the /rest/staffResource/update API endpoint until a patch is available. Avoid using the First Name parameter in the affected API endpoint until the issue is resolved.