A vulnerability exists in the University Management System 1.0. An unknown functionality in /view_result.php accepts a vr parameter that can be manipulated to inject arbitrary client‑side script, resulting in a reflected cross‑site scripting flaw (CWE-79, CWE-94). The flaw allows an attacker to run malicious JavaScript in the victim’s browser, potentially stealing session data, performing phishing, or defacing the page. The vulnerability is exploitable remotely by sending a crafted URL to a user.

The only affected product listed is itsourcecode:University Management System 1.0. No other versions or sub‑versions are specified, indicating the issue is limited to this release.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is less than 1%, suggesting low exploitation probability. It is not present in the CISA KEV catalog. The attack vector is a malicious URL that manipulates the vr parameter, which a victim can trigger by clicking a link in email or other media. While publicly disclosed, effective exploitation requires user interaction and may be mitigated by standard input validation.