CVE-2026-82697

Name of the Vulnerable Software and Affected Versions sambitraj Student-Management-System versions prior to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5

Description A remote attack can be launched against the session start() function, resulting in cookies being issued without the 'httponly' flag. The 'httponly' flag is a security measure that prevents client-side scripts from accessing the cookie, which helps mitigate the risk of session theft via cross-site scripting.

Recommendations As a temporary workaround, consider restricting the use of the session start() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.