CVE-2026-12176: XSS Vulnerability in SourceCodester CET Automated Grading System 1.0

Technical summary

CVE-2026-12176 is a reflected XSS flaw (CWE-79, CWE-94) affecting an unknown function within /index.php of the CET Automated Grading System. The 'action' parameter is not properly sanitized or encoded before being rendered in HTTP responses. An attacker can construct a URL containing JavaScript payloads that execute in the context of the victim's session. The vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM), reflecting network accessibility and low attack complexity, though impact is limited to integrity (no confidentiality or availability impact). The requirement for user interaction and same-origin policy constraints limit exposure, but the public disclosure lowers the bar for exploitation.

Business impact

Institutions deploying the CET Automated Grading System face reputational and operational risks. Attackers could use this XSS to steal session tokens from teachers or administrators, redirect users to phishing sites, or modify grades and course content in real time during a student's exam session. Educational institutions are trusted custodians of sensitive student data; a compromise could trigger regulatory scrutiny and erode stakeholder confidence. The system's AI Predictive Analytics features may also be poisoned if an attacker modifies student records before prediction models consume them.

Affected systems

SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 is confirmed vulnerable. No patch version has been identified in available advisories; verify current version status and availability of updates directly with SourceCodester. If you operate any instance of this product, prioritize inventory and isolation until a patch is confirmed.

Exploitability

Exploitation is straightforward and requires no special privileges. An attacker sends a victim a crafted URL or embeds it in an email or social media post. When the victim clicks and is logged into the CET system, the malicious script executes in their browser. Public disclosures reduce the time window before automated scanning and opportunistic attacks begin. The attack does not require sophisticated tooling—basic URL encoding and JavaScript knowledge suffice. However, success depends on the victim's engagement and existing authentication session.

Remediation

Contact SourceCodester immediately to verify patch availability. If no patch exists, implement input validation and output encoding on the 'action' parameter and all user-controlled inputs in /index.php. Apply a Web Application Firewall (WAF) rule to block or sanitize requests containing JavaScript event handlers or encoded script tags in the 'action' parameter. Educate users not to click untrusted links while logged into the grading system. Consider network segmentation to limit access to the CET system to trusted IP ranges.

Patch guidance

Check SourceCodester's official security advisories and support portal for patches addressing CVE-2026-12176. Verify the patch version number against the vendor advisory before deployment. If the vendor has released a patch, test it in a non-production environment first, paying attention to any changes in parameter handling or authentication. If no official patch is available, prioritize deploying compensating controls (WAF rules, input validation hardening, network isolation) and plan a migration timeline away from the vulnerable version.

Detection guidance

Monitor web server logs for /index.php requests with suspicious 'action' parameter values, particularly those containing script tags, event handlers (onerror, onload, onclick), or URL-encoded variants. Look for encoded payloads such as %3Cscript%3E, %3Bjavascript:, or %27onerror%3D. Implement SIEM rules to flag unusual referrers sending users to your CET system. Use a WAF to log and alert on XSS-like patterns in real time. If possible, enable verbose request logging in the application to correlate XSS attempts with user sessions and detect lateral movement.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability merits prompt attention in educational and assessment environments. Public exploit availability accelerates the timeline before mass scanning and compromise. The attack surface is simple (a single web-facing parameter), making it a quick win for attackers. If the CET system stores or processes student records, grades, or personally identifiable information, a compromise undermines institutional integrity and may trigger compliance obligations (FERPA, GDPR, etc.). Prioritize this above purely internal vulnerabilities but below CRITICAL flaws lacking public exploit details.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a low-complexity, network-accessible attack that requires user interaction and yields only integrity impact (modification of what the user sees, not confidentiality or availability loss). The score would be higher if the vulnerability allowed unauthenticated account takeover or direct data exfiltration, but the reflected XSS nature and same-origin policy constraints limit scope. However, in an educational context, even limited integrity compromise can have disproportionate consequences (altering student grades, records), so organizational risk may exceed the numerical score.

Frequently asked questions