This vulnerability in SourceCodester Student Grades Management System 1.0 involves stored cross-site scripting (CWE-79) in the create_classroom function of /classroom.php. Manipulation of the name or description parameters allows an attacker with high privileges and requiring user interaction to inject malicious scripts that are stored and later executed in users' browsers. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The attacker must have high privileges and user interaction is required to trigger the vulnerability.

No official patch or remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users and consider implementing input validation or sanitization on the name and description fields to mitigate stored XSS risks.