ProjectsAndPrograms school‑management‑system suffers from a stored cross‑site scripting flaw in several attributes of student and teacher objects. A user with sufficient authority, such as a teacher or administrator, can place malicious JavaScript in these fields, and the code is subsequently executed in the browsers of any other user who views the affected pages. When combined with the unrelated CVE‑2025‑11661 vulnerability, which permits unauthenticated access to backend endpoints, the stored XSS can be triggered by a remote attacker without requiring any prior privileges.

The vulnerability impacts the ProjectsAndPrograms school‑management‑system. No official release number is documented; the commit 6b6fae5 was tested and confirmed vulnerable, while other releases were not examined and may or may not be affected.

The CVSS score of 5.1 indicates moderate severity. Because no EPSS data is available and the vulnerability is not listed in CISA KEV, the likelihood of widespread exploitation is uncertain but could increase if the system is publicly accessible. An attacker with teacher or admin rights can directly inject malicious payloads; a remote attacker can achieve the same effect via the authentication bypass CVE‑2025‑11661. The impact is limited to clients’ browsers but can facilitate further compromise of the environment if additional privileges are gained.