The vulnerability resides in the admission_form_check.php file of the Student Management System by PHP. A crafted Message parameter can be processed without proper sanitization, allowing an attacker to inject arbitrary JavaScript code that will run in the victim’s browser. This can lead to session hijacking, defacement, or phishing, thereby compromising the confidentiality, integrity, and availability of the application for any user who visits the affected page.

The affected product is raisulislamg4’s Student Management System by PHP, distributed as a rolling release with no specific version data available. Any deployment that includes the admission_form_check.php file before the fix remains vulnerable, and the project has not yet released a corrective patch.

The use of a remotely deliverable payload is evidenced by the availability of a public exploit. With a CVSS score of 5.1 the threat is classified as medium severity, while the absence of an EPSS score leaves the likelihood of real‑world exploitation uncertain. The situation is not listed in the CISA KEV catalog, but the public exploit and the lack of a timely response increase the urgency for mitigation. The likely attack vector is a remote web request to the vulnerable script, which does not require local access or privileged credentials.