A cross‑site scripting vulnerability exists in the Announcement Management module of the code‑projects Online Student Management System 1.0. The flaw is located in an undisclosed function of the /admin/announcement/index.php?view=add page, where user input is rendered without proper escaping. Attackers can supply crafted data that results in arbitrary JavaScript executing in the browsers of users who view the vulnerable page. The weakness is identified as CWE‑79, with an associated code‑injection aspect labeled CWE‑94.

The vulnerability affects the code‑projects Online Student Management System version 1.0, specifically the admin/announcement module used for adding announcements; no other versions or products are listed as impacted.

The CVSS base score of 4.8 indicates low‑to‑moderate severity. The EPSS score of less than 1 % suggests a very low likelihood of real‑world exploitation, and the flaw is not cataloged in the CISA KEV list. The attack is remote and can be performed by sending a crafted request or a malicious link to the vulnerable endpoint. A publicly available exploit means that any user who accesses the affected page while logged in or unauthenticated is at potential risk. The exact extent of damage—such as session hijacking, defacement, or redirection—is typical for XSS but is not explicitly detailed in the CVE report; these effects are inferred as common outcomes when script execution occurs.