The vulnerability in PHPGurukul Student Record Management System 1.0 arises from improper handling of the Subject 1 argument in edit‑subject.php, allowing attackers to inject malicious scripts into web pages. This reflected cross‑site scripting can enable session hijacking, defacement, or theft of user credentials and is linked to CWE‑79 for reflected XSS and CWE‑94 for code injection potential. The issue is exploitable remotely via the web interface and the exploit code is publicly available.

The affected product is PHPGurukul Student Record Management System version 1.0, deployed by the PHPGurukul vendor. No other product versions are listed as vulnerable.

The CVSS score of 4.8 denotes a moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at this time. The risk is not elevated by inclusion in the CISA KEV catalog. Attackers can manipulate the Subject 1 parameter through typical web requests to trigger reflected script execution, making remote exploitation feasible but not widespread.