A reflected Cross‑Site Scripting vulnerability exists in the School Management System by mahmoudai1. An unauthenticated attacker can supply an arbitrary value for the 'type' query parameter in register.php. The value is returned unescaped in the browser, allowing an attacker to inject and execute malicious JavaScript within the victim’s browser context. This client‑side execution can lead to session hijacking, credential theft, defacement, or phishing attempts against users who visit the vulnerable page.

The vulnerability is present in the School Management System repository hosted by mahmoudai1 on GitHub. No specific version information has been provided, so the issue affects all available releases of the application as distributed in that repository.

Because the flaw is triggered by a GET parameter and does not require authentication, any external user can exploit it. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The lack of an advisory or patch suggests that exploitation is straightforward, making the risk high. An attacker can inject scripts that run in the context of any user who accesses the malformed URL.