A flaw was discovered in the Student Management System 1.0, where an unknown function in the "/add_student/" module accepts unsanitized input that is reflected into web pages. This vulnerability allows an attacker to inject malicious scripts that execute in the browsers of users who view the affected pages. Because the attack is performed remotely through the web interface, any user who visits a crafted page could suffer from cookie theft, session hijacking, or defacement of the user interface. The public availability of the exploit increases the potential for real‑world attacks.

The flaw affects itsourcecode Student Management System version 1.0. No other affected versions are listed.

The CVSS score for this issue is 4.8, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at the time of assessment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web request to the Add Student form, where unsanitized values are reflected back to the client without proper escaping or filtering. An attacker with internet access can construct a malicious payload that is delivered to end‑users via the application, enabling client‑side code execution.