ZeroWdd studentmanager LeaveController.java addLeave クロスサイトスクリプティング

The XSS vulnerability in ZeroWdd studentmanager allows an attacker to inject arbitrary JavaScript code into the application's web pages. This can be exploited to steal user cookies, redirect users to malicious websites, or deface the application. Successful exploitation could lead to unauthorized access to sensitive student data, including grades, attendance records, and personal information. The remote nature of the vulnerability means an attacker doesn't need to be on the same network as the studentmanager server, significantly broadening the potential attack surface. Given the public disclosure, the risk of exploitation is elevated.

Educational institutions and organizations utilizing ZeroWdd studentmanager are at risk. Specifically, deployments where user-provided data is directly reflected in web pages without proper sanitization are particularly vulnerable. Users who rely on the studentmanager for sensitive student data management should prioritize implementing the recommended mitigations.

• java / server:

grep -r "Reason for Leave" src/main/java/com/wdd/studentmanager/controller/LeaveController.java | grep -i "<script"

• generic web:

curl -I <studentmanager_url>/leave/add | grep -i "X-XSS-Protection"

1. 2026-02-09Disclosure

   disclosure

1. 予約済み2026-02-07
2. 公開日2026-02-09
3. 更新日2026-02-23
4. EPSS 更新日2026-03-23

Due to the rolling release model of ZeroWdd studentmanager, a direct patch is not immediately available. The primary mitigation strategy involves implementing robust input validation and output encoding on the 'Reason for Leave' field within the LeaveController.java file. Specifically, sanitize user-supplied input to prevent the injection of HTML or JavaScript code. Consider using a WAF (Web Application Firewall) to filter out malicious requests. Regularly review and update the application's codebase to address potential vulnerabilities. After implementing these mitigations, thoroughly test the application to ensure that the vulnerability has been effectively addressed and no new issues have been introduced.