A flaw in itsourcecode University Management System 1.0 allows an attacker to inject arbitrary script when the application processes the dt argument in /att_single_view.php. This causes a reflected XSS vulnerability that can be triggered from a remote location. If successfully exploited, the attacker could execute arbitrary JavaScript in the victim’s browser, potentially leading to session hijacking, defacement, or delivery of additional malicious payloads.

The vulnerability exists in itsourcecode:University Management System version 1.0. No other affected versions are listed.

The CVSS score of 5.3 indicates moderate impact, while the EPSS score of less than 1% suggests rare exploitation. Because the issue is exploitable remotely via a web request, attackers may craft a malicious URL that includes a tampered dt parameter. The absence of the vulnerability from the CISA KEV catalog does not reduce the need for remediation, but the low exploitation probability means that immediate urgency may be lower compared to high‑profile bugs. Nonetheless, any exposed XSS presents a serious security risk, especially in web applications that handle authentication or sensitive data.