A reflected cross‑site scripting vulnerability was found in the Admission Enquiry module of QDOCS Smart School Management System. The flaw is triggered by manipulating the Note argument sent to the /admin/enquiry endpoint. When the input is not properly sanitized, the resulting script is executed in the browsers of users who view the affected page, potentially allowing session hijacking, credential theft, defacement or other client‑side attacks.

The issue affects QDOCS Smart School Management System versions up to and including 7.2. Any installation that contains the Admission Enquiry component accessed through /admin/enquiry is potentially vulnerable.

The CVSS base score of 5.1 indicates moderate severity. No EPSS score is reported and the vulnerability is not listed in the CISA KEV catalog. According to the description, the exploit can be performed remotely by submitting a crafted request to the vulnerable endpoint. The vulnerability is a classic reflected XSS and has no stated authentication requirement, implying that users who can reach the endpoint may be able to trigger it. The attack would rely on user interaction for the payload to execute.