A flaw in the edit‑course.php page of PHPGurukul Student Record Management System allows an attacker to inject and execute arbitrary scripts through the Course Short Name field. An attacker can supply a crafted value that is rendered without sanitization, resulting in client‑side script execution whenever a user visits the page. The weakness is an improper neutralization of input (CWE‑79) and can also be viewed as an improper control of code generation (CWE‑94).

The vulnerability exists in PHPGurukul Student Record Management System up to version 1.0. The affected component is the edit‑course.php file; no other modules or versions are listed as affected.

The CVSS base score of 4.8 indicates moderate severity. The EPSS score of less than 1 % suggests a very low probability of exploitation at the time of this analysis. The attack requires remote interaction: an attacker must supply a malicious Course Short Name parameter to the publicly reachable edit‑course.php endpoint. The vulnerability is not found in the CISA KEV catalog, so no widespread exploitation campaigns are currently documented.