{"id":"CVE-2026-86226","state":"PUBLISHED","title":"Projectwolds Online Attendance System profile.php cross site scripting","description":"A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.","publishedAt":"2026-09-06T22:00:09.891Z","updatedAt":"2026-09-08T15:04:23.678Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Projectwolds Online Attendance System"],"affected":[{"vendor":"Projectwolds","product":"Online Attendance System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:projectwolds:online_attendance_system:*:*:*:*:*:*:*:*"]}],"references":["https://vuldb.com/vuln/399379","https://vuldb.com/vuln/399379/cti","https://vuldb.com/cve/CVE-2026-86226","https://vuldb.com/submit/898328","https://github.com/CyberShailendra1/Online-Attendance-System-Projectworlds"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/86xxx/CVE-2026-86226.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-86226","state":"PUBLISHED","datePublished":"2026-09-06T22:00:09.891Z","dateUpdated":"2026-09-08T15:04:23.678Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-06T04:05:07.375Z"},"containers":{"cna":{"title":"Projectwolds Online Attendance System profile.php cross site scripting","descriptions":[{"lang":"en","value":"A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks."}],"affected":[{"vendor":"Projectwolds","product":"Online Attendance System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:projectwolds:online_attendance_system:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://vuldb.com/vuln/399379","name":"VDB-399379 | Projectwolds Online Attendance System profile.php cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/399379/cti","name":"VDB-399379 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-86226","name":"CVE-2026-86226 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/898328","name":"Submit #898328 | Projectwolds Online Attendance System in PHP MYSQL 1.0 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://github.com/CyberShailendra1/Online-Attendance-System-Projectworlds","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-06T22:00:09.891Z"},"timeline":[{"time":"2026-09-06T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-06T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-06T06:10:12.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"CyberShailendra (VulDB User)","type":"reporter"}],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-08T15:03:50.294617Z","id":"CVE-2026-86226","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-08T15:04:23.678Z"}}]}}}