CVE-2026-3984

Vulnerability

Overview

A stored cross-site scripting (XSS) vulnerability exists in Campcodes Division Regional Athletic Meet Game Result Matrix System version 2.1. The flaw resides in the save_up_athlete.php file, where the `a_name parameter is not properly sanitized before being stored and later rendered in the application. This allows an attacker to inject arbitrary HTML or JavaScript code that will be executed in the context of other users' browsers when they view the affected athlete's profile [2].

ExploitationThe vulnerability can be triggered remotely without authentication, as the application fails to validate or encode user-supplied input in the a_name field. A proof-of-concept payload such as test demonstrates that the injected script is stored and executed upon page reload [2].

ImpactAn attacker can exploit this stored

XSS to execute arbitrary script code in the browsers of other users, potentially leading to session hijacking, data theft, or defacement of the application. The CVSS v3 base score is 3.5 (Low), reflecting the need for user interaction to trigger the attacker does not gain direct control over the server [1].

MitigationThe vendor, Campcodes, has not released a patch as of the publication date. Users should apply input validation and output encoding to the a_name parameter, or consider disabling the affected functionality or upgrading to a newer version if available [1][2].