CVE-2026-127282

CVSS 4.3 (medium) · published 2026-11-13

A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality of the file reset_password.php. This manipulation of the argument Username causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Weakness: CWE-79, CWE-94

Source: NVD CVE-2026-127282

References

• https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-07-Reflected-XSS-ResetPassword.md
• https://vuldb.com/cve/CVE-2026-127282
• https://vuldb.com/submit/1041018
• https://vuldb.com/vuln/436448
• https://vuldb.com/vuln/436448/cti
• https://www.sourcecodester.com/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.