The vulnerability occurs in the /add.php functionality of the imvks786 student_management_system. By manipulating the arguments name, address, or fname, a malicious user can inject arbitrary script code that is rendered by a victim’s browser. An attacker could insert a JavaScript payload, leading to session hijacking, credential theft, defacement, or other client‑side attacks. The flaw is a classic reflected XSS flaw identified as CWE‑79, and secondarily a code injection weakness (CWE‑94) if execution of injected PHP code is possible.

The affected product is imvks786: student_management_system. All releases up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46 are vulnerable. Because the project uses a rolling release model, explicit version numbers are not provided, so any deployment that includes code prior to that commit is at risk.

The CVSS score of 5.1 indicates a medium severity; the EPSS score is not available, so the current exploitation probability cannot be quantified, but the vulnerability is publicly disclosed and can be triggered remotely via crafted requests. It is not included in the CISA KEV catalog, yet it remains an active local or remote attack vector. An attacker with access to the web interface could immediately exploit it, especially if the application does not employ proper input sanitization or output encoding. The potential impact on confidentiality and integrity is significant, while availability is not directly affected.