A reflected XSS flaw is present in the /studentms/admin/contact‑us.php script of the 1.0 release of manikandan580 School‑management‑system. The vulnerability arises when a value supplied in the email POST parameter is echoed back to the browser without proper encoding. If an attacker supplies malicious JavaScript in this field, the script will run in the context of an admin’s browser session, potentially allowing cookie theft, session hijack, or execution of arbitrary code.

This vulnerability affects only the 1.0 version of the School‑management‑system by the developer named manikandan580. No other vendors or product variants are listed in the advisory, and no specific CPE strings are provided.

The CVSS base score is 6.1, and the EPSS score is < 1%, so a precise quantitative risk cannot be calculated. Based on the description, the flaw can be triggered remotely via an HTTP POST to the contact‑us page, and the email field can be supplied by an attacker. The absence of explicit authentication requirements in the advisory means it is unclear whether only authenticated users can reach the page; however, the lack of such detail allows us to infer that if the page is accessible, an attacker could craft a link or form to deliver the payload. The vulnerability is not listed in the CISA KEV catalog.