An attacker can submit a malicious script via the pagedes POST parameter on the /studentms/admin/contact‑us.php page. The page echoes the supplied value back to the browser without proper filtering, allowing the payload to execute in the context of the victim’s session. This can lead to session hijacking, credential theft, defacement, or execution of arbitrary code within the victim’s browser. The issue is a classic reflected XSS weakness (CWE‑79).

Version 1.0 of the School‑management‑system developed by the user manikandan580 is impacted. No other vendors or products are listed as affected.

The vulnerability carries a CVSS score of 6.1, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploits yet. The likely attack path requires the attacker to send a crafted POST request to the contact‑us page, from which the malicious JavaScript is returned to the victim’s browser. The impact is limited to browsers that load the echoed value and does not automatically grant system compromise beyond the user’s session.