The identified flaw is a reflected cross‑site scripting vulnerability in the fetch.php component of the CollegeManagementSystem. An attacker can supply a crafted department_name parameter that is echoed back without proper escaping, allowing malicious JavaScript to execute in the victim’s browser. This may lead to session hijacking, phishing attacks, or unauthorized disclosure of data.

The vulnerability exists in the current rolling‑release version of the CollegeManagementSystem maintained by tittuvarghese. The affected code resides in /dashboard_page/forms/fetch.php, and because the project delivers continuous updates, no specific version numbers are provided. Any deployment that includes this component is potentially affected.

The CVSS score of 5.3 indicates a medium severity. No EPSS data are available, so the likelihood of exploitation is uncertain, but the public exploit demonstrates that remote attackers can trigger the flaw by providing a malicious department_name value. Although the issue is not listed in the CISA KEV catalog, its public disclosure and remote nature raise concern for exposed installations that accept untrusted input.