The flaw enables an attacker to inject malicious script through the Name argument in the Students Controller view_students.php function, leading to cross‑site scripting. This weakness, classified as CWE‑79 and associated with code injection (CWE‑94), can run arbitrary client‑side code in the victim’s browser, compromising confidentiality, integrity, and availability of user sessions and potentially defacing the application.

The vulnerable component is hemant6488 CodeIgniter‑StudentManagementSystem, specifically the Students Controller view_students.php. The project follows a rolling release model, so no precise affected version can be listed. All releases that have not applied an update may remain vulnerable.

The CVSS base score of 5.3 indicates a moderate severity vulnerability. An attacker can exploit it remotely and the public exploitation evidence suggests that scripts are already available for launch. Because the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, the exact exploitation probability remains unknown, but the presence of an existing publicly available exploit increases the risk to all exposed instances.