A cross‑site scripting flaw exists in the admin Add Notice endpoint of the Cyber‑III Student‑Management‑System. By manipulating the $_SERVER['PHP_SELF'] value used in /admin/Add%20notice/notice.php, an attacker can inject JavaScript that executes in the browsers of users who view the affected page. This flaw allows the theft of session data, defacement, or other malicious actions performed under the victim’s permissions. The weakness is an example of unchecked user‑controlled input leading to a stored or reflected XSS (CWE‑79).

All released builds of the Cyber‑III Student‑Management‑System up to the code commit 1a938fa61e9f735078e9b291d2e6215b4942af3f are affected; no specific release numbers are available due to the project’s rolling release model.

The CVSS score of 4.8 indicates moderate severity, and the lack of EPSS data and KEV listing underlines limited publicly known exploitation efforts, yet the publicly available exploit and the ability to trigger the flaw remotely from any external host make the risk tangible for exposed installations.