The flaw in student.php allows an attacker to insert arbitrary JavaScript through manipulation of the FIRST_NAME parameter, which the application renders without escaping. This cross‑site scripting capability lets the attacker run code in the victim’s browser, potentially stealing cookies, hijacking sessions, or defacing web pages. The vulnerability is a classic input‑validation weakness identified by CWE‑79 and, according to the source, may also involve code injection mechanisms (CWE‑94). The impact is confined to the client side; it does not grant the attacker server‑side code execution or data exfiltration beyond what the injected script can access.

The impacted product is yashpokharna2555's StudentManagementSystem. No specific version details are provided because the project uses continuous delivery and rolling releases, so the CVE notes that no affected or updated release versions are known. The references point to the project's GitHub repository and public vulnerability reports, indicating that any release of the system is potentially vulnerable.

The CVSS score is 5.1, placing the vulnerability at medium severity. The EPSS score is unavailable, but the attack is described as publicly usable and can be launched remotely by sending a crafted HTTP request with a malicious FIRST_NAME field. The product is not listed in the CISA KEV catalog. Because the flaw stems from inadequate input sanitization, the risk remains open until the maintainer issues a patch or until mitigations are applied at the application level. The attack vector is remote, and the Q&A describes it as a client‑side XSS scenario rather than a server‑side code execution vulnerability.