CVE-2026-2201
ZeroWdd studentmanager LeaveController.java addLeave cross site scripting
- Published
- Updated
- Reserved
- Assigned by
- VulDB
Description
A security vulnerability has been detected in ZeroWdd studentmanager up to 2151560fc0a50ec00426785ec1e01a3763b380d9. This impacts the function addLeave of the file src/main/java/com/wdd/studentmanager/controller/LeaveController.java. The manipulation of the argument Reason for Leave leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The code repository of the project has not been active for many years.
Public exploit
A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.
Timeline
ID reserved
By VulDB
- 2 days later
· 2 days later
Published
- 14 days later
· 14 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulDBCNA (assigner) | 4.0 | Medium4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| VulDBCNA (assigner) | 3.1 | Low2.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R |
| VulDBCNA (assigner) | 3.0 | Low2.4 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R |
| VulDBCNA (assigner) | 2.0 | Low3.3 | AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR |
| NVDNVD · Analyzed | 4.0 | Low1.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.26% · top 82% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.
Weakness
Affected products
- affected 2151560fc0a50ec00426785ec1e01a3763b380d9
References (4)
- VDB-344904 | ZeroWdd studentmanager LeaveController.java addLeave cross site scripting (opens in a new tab)vdb-entrytechnical-description
- VDB-344904 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
- Submit #750217 | https://github.com/ZeroWdd/studentmanager/ https://github.com/ZeroWdd/studentmanager/issues 1.0 Improper Neutralization of Input During Web Page Generation (opens in a new tab)third-party-advisory
- https://www.yuque.com/clockw1se/lts9x9/mxgrzspnzmpxu7e7 (opens in a new tab)exploit
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-2201)Record last updated .