CVE-2025-51411

A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint. The application fails to properly sanitize user input before reflecting it in the HTML response. This allows unauthenticated attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser by tricking them into visiting a crafted URL or submitting a malicious form. Successful exploitation may lead to session hijacking, credential theft, or other client-side attacks.

• CWE-79

• https://github.com/tansique-17/CVE-2025-51411/Exploit, Third Party Advisory
• https://github.com/tansique-17/CVE-2025-51411/Exploit, Third Party Advisory

Published

Jul 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51398A stored cross-site scripting (XSS) vulnerability in the Fac…5.4
• CVE-2025-5140A vulnerability classified as critical has been found in See…6.3
• CVE-2025-51400A stored cross-site scripting (XSS) vulnerability in the Per…5.4
• CVE-2025-51401A stored cross-site scripting (XSS) vulnerability in the cha…5.4
• CVE-2025-51403A stored cross-site scripting (XSS) vulnerability in the dep…6.5
• CVE-2025-5141A binary in the BoKS Server Agent component of Fortra's Core…5.5
• CVE-2025-51414In Phpgurukul Online Course Registration v3.1, an arbitrary …8.8
• CVE-2025-5142The Simple Page Access Restriction plugin for WordPress is v…6.5
• CVE-2025-51427An issue was discovered in ModelScope 1.25.0 allowing attack…7.3
• CVE-2025-5143The TableOn – WordPress Posts Table Filterable plugin for Wo…5.4
• CVE-2025-5144The The Events Calendar plugin for WordPress is vulnerable t…5.4
• CVE-2025-5145A vulnerability, which was classified as critical, was found…6.3