PT-2025-30815 · Unknown · Institute-Of-Current-Students

Tansique Dasari · Published 2025-07-25 · Updated 2025-07-25 · CVE-2025-51411

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Institute-of-Current-Students version 1.0

Description A reflected cross-site scripting (XSS) issue exists due to improper sanitization of user input. Specifically, the application fails to sanitize the email parameter before reflecting it in the HTML response. This allows attackers to inject and execute arbitrary JavaScript code in the context of a victim’s browser. Successful exploitation may lead to session hijacking or credential theft. The vulnerable endpoint is /postquerypublic.

Recommendations Institute-of-Current-Students version 1.0: Sanitize user input for the email parameter in the /postquerypublic endpoint to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-51411

Affected Products

Institute-Of-Current-Students

References · 4

• 🔥 https://github.com/tansique-17/CVE-2025-51411 · Exploit
• https://osv.dev/vulnerability/CVE-2025-51411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51411 · Security Note
• https://twitter.com/CVEnew/status/1948733595889058137 · Twitter Post