Security readout for executives and security teams
Plain-English summary
This issue is a stored cross-site scripting flaw in PHP Scripts Mall Student Profile Management System Script v2.0.6. A student Name value can be saved and later rendered by list_student.php in a way that may run script in another user's browser. Business impact depends on whether this legacy application is deployed and who can view student lists.
Executive priority
Treat this as a targeted legacy-application risk. Prioritize if the system is internet-facing, handles student data, or is viewed by administrators. If the product is not deployed, no direct action is needed beyond documenting non-exposure.
Technical view
CVE-2018-6935 describes XSS through the Name field to list_student.php in Student Profile Management System Script v2.0.6. The public record does not provide CVSS, CWE, authentication requirements, affected CPEs, fixed versions, or vendor mitigation details. KEV status is false in the supplied bundle.
Likely exposure
Exposure is likely limited to organizations that still run PHP Scripts Mall Student Profile Management System Script v2.0.6 or derived code. Internet exposure, administrative access patterns, and authentication requirements are not established by the supplied sources.
Exploitation context
The supplied sources identify a public XSS report, but do not show CISA KEV listing or confirmed active exploitation. Stored XSS can matter when privileged users view affected records, but available evidence does not prove real-world exploitation or impact scope.
Researcher notes
Evidence is sparse: one referenced public report and CVE metadata. The bundle does not include CVSS scoring, patch status, authentication context, or proof of exploitation. Validate exposure directly before assigning urgency beyond a typical stored XSS issue.
Mitigation direction
- Inventory for Student Profile Management System Script v2.0.6 deployments or forks.
- Check PHP Scripts Mall or maintainer guidance for fixed versions or advisories.
- Restrict access to student management pages until exposure is understood.
- Sanitize and HTML-encode Name output in list_student.php if maintaining code.
- Review stored student Name values for suspicious markup or script-like content.
Validation and detection
- Confirm whether the application and exact version are present in production or staging.
- Identify every route that displays student Name values, especially list_student.php.
- Test safely that Name values render as text, not executable browser content.
- Review access logs for unusual student record creation or edits.
- Verify compensating controls do not replace proper output encoding.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-6935 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://0day4u.wordpress.com/2018/03/19/student-profile-management-system-script-stored-xss/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.