Vulnerability · Published Mar 27, 2026 · Assigned by VulDB
CVE-2026-4991QDOCS Smart School Management System Admission Enquiry enquiry cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in Smart School Management System from QDOCS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.2%top 91.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admin/enquiry of the component Admission Enquiry Module. Performing a manipulation of the argument Note results in cross site scripting. The attack is possible to be carried out remotely.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QDOCS | Smart School Management System | 7.07.17.2 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:X
References
- VDB-353878 | QDOCS Smart School Management System Admission Enquiry enquiry cross site scripting vdb-entry, technical-description
- VDB-353878 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #776300 | QDOCS Smart School : School Management System 7.2 Cross Site Scripting third-party-advisory