A remote web vulnerability exists in the Student‑Management System’s delete_batch.php endpoint. By manipulating the batch argument sent to the file, an attacker can inject arbitrary JavaScript that is reflected back to the victim’s browser. This reflected cross‑site scripting would allow a malicious actor to execute code within the context of any user who views the affected page, potentially stealing session cookies, credentials, or injecting malicious content. The weakness is based on improper input handling and rendering, making the application vulnerable to client‑side attacks.

The vulnerability applies to all releases of the Cyber‑III Student‑Management‑System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f. The project does not enforce version numbers, so any deployment of the code base that has not been updated beyond this point is affected. The system component in question is the Class Schedule Deletion Endpoint located at /admin/class%20schedule/delete_batch.php.

The CVSS score for this issue is 5.3, indicating moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, so it does not receive additional alerting. The attack vector is remote; any user who can submit a crafted request to the endpoint can trigger the XSS. Because the flaw is publicly disclosed and a product without formal versioning has no patch release, the exploitation likelihood remains moderate, but the potential for credential theft is significant.