A flaw in the University Management System’s admin_single_student_update.php allows an attacker to inject arbitrary JavaScript by manipulating the st_name parameter. This cross‑site scripting vulnerability permits execution of malicious code in the browsers of users who view pages containing the injected content, potentially leading to session hijacking, defacement, or redirection to malicious sites.

The vulnerability affects itsourcecode University Management System version 1.0. Specifically the admin_single_student_update.php endpoint, which handles student record updates. No other versions or editions are listed as affected.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation. The vulnerability is not present in CISA’s KEV catalog, and no authentication requirement is explicitly mentioned, so remote exploitation appears feasible from the internet if the application is publicly accessible. An exploit has been published, confirming that attackers can manipulate the st_name field to trigger the XSS effect.