The vulnerability is a cross‑site scripting flaw in the addLeave endpoint of ZeroWdd studentmanager. By supplying a specially crafted Reason for Leave value, an attacker can inject malicious JavaScript that will execute in the browser of any user who views the resulting page. This allows cookie theft, session hijacking, and potentially the execution of arbitrary actions on behalf of the victim. The weakness corresponds to CWE‑79 and may also involve code injection (CWE‑94) depending on the context of the injected payload.

ZeroWdd studentmanager, any release up to commit 2151560fc0a50ec00426785ec1e01a3763b380d9, is affected. The project uses a rolling release model and is no longer actively maintained, so specific patched versions are not publicly listed. Operators should consider that all currently deployed copies of the application are potentially vulnerable.

The CVSS score of 4.8 classifies the flaw as medium severity, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild at this time. The vulnerability is not listed in CISA’s KEV catalog. Because the application is reachable over the web, the attack can be launched remotely by any user who can submit a leave request. The absence of an official patch makes the risk higher until a fix is released.