A stored Cross‑Site Scripting flaw was discovered in the edit_user.php page of the Society Management System Portal version 1.0. The vulnerability allows an attacker to inject arbitrary JavaScript into the user name field through a POST request. When another user, including administrators, views the altered content, the malicious script is executed in their browser. This is classified as CWE‑79 and represents a client‑side script injection that does not directly compromise the server.

The affected product is the Society Management System Portal 1.0 from vendor Kashipara. No other vendors or versions are listed.

The CVSS base score of 6.1 indicates a moderate severity vulnerability. The EPSS score is less than 1 %, reflecting a low probability that this flaw will be actively exploited in the wild, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must craft a POST request to the administrative edit endpoint and then rely on another user to view the stored value for the script to execute. The malicious script runs in the victim’s browser, but does not grant server‑side code execution.