CVE-2026-3982

A reflected cross-site scripting (XSS) vulnerability exists in the /view_result.php file of itsourcecode University Management System 1.0. The root cause is the lack of proper input validation and output encoding for the 'vr' parameter; user-supplied data is directly rendered into the web page, allowing injection of arbitrary HTML and JavaScript code [1].

Exploitation does not require authentication. An attacker can craft a malicious URL containing a script payload in the vr parameter and lure a victim to visit it. For example, the payload `` demonstrates script execution. The vulnerability is publicly known and can be triggered remotely [1].

Impact includes theft of cookies and session tokens, which could lead to account takeover. The attacker can also perform actions impersonating the victim, deface content, redirect users to malicious websites, or gain further control over the victim's browser, posing a significant threat to confidentiality and integrity [1].

No official patch has been announced. Users are advised to sanitize the 'vr' parameter and apply output encoding to prevent XSS attacks. Since the exploit code is public, immediate mitigation is recommended [1].