PT-2026-7045 · Unknown · Zerowdd Studentmanager

Clock12138 · Published 2026-02-09 · Updated 2026-03-05 · CVE-2026-2201

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZeroWdd studentmanager versions prior to 2151560fc0a50ec00426785ec1e01a3763b380d9

Description A security issue exists in ZeroWdd studentmanager. The addLeave function within the src/main/java/com/wdd/studentmanager/controller/LeaveController.java file is susceptible to cross site scripting due to manipulation of the Reason for Leave argument. This attack can be initiated remotely. The exploit has been publicly disclosed. The product employs a rolling release model, making specific version details for updates unavailable. The project's code repository is no longer actively maintained.

Recommendations As a temporary workaround, consider disabling the addLeave() function until a fix is available. Sanitize the Reason for Leave input to prevent the injection of malicious scripts. Restrict access to the LeaveController.java file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-2201

Affected Products

Zerowdd Studentmanager

References · 10

• 🔥 https://yuque.com/clockw1se/lts9x9/mxgrzspnzmpxu7e7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2201 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2201 · Vendor Advisory
• https://vuldb.com/?submit.750217 · Note
• https://vuldb.com/?ctiid.344904 · Note
• https://t.me/cveNotify/151346 · Telegram Post
• https://t.me/CVEtracker/44149 · Telegram Post
• https://t.me/cveNotify/154414 · Telegram Post
• https://twitter.com/CVEnew/status/2020712716361462248 · Twitter Post
• https://vuldb.com/?id.344904 · Note