The vulnerability allows an attacker to inject arbitrary JavaScript code by manipulating the server variable $_SERVER['PHP_SELF'] in the file /admin/Add notice/batch-notice.php, which is then executed in the browsers of users who submit the batch notice. "The attack can be initiated remotely."

The Cyber‑III Student‑Management‑System is affected in any release that contains or precedes commit 1a938fa61e9f735078e9b291d2e6215b4942af3f. No official patch or updated release has been issued, and the project has not responded to the issue. The product uses continuous delivery with rolling releases, so version numbers are not clearly identified beyond this commit reference. "Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."

The CVSS score is 4.8, indicating a low‑moderate severity level. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploit code is publicly available, and the flaw can be triggered from a remote location. Because the flaw involves user‑controlled input, the attack surface remains open unless the vendor provides a fix or the deployment implements mitigating controls.