The vulnerability CVE-2025-65134 affects manikandan580 School-management-system version 1.0. It is a reflected cross-site scripting (XSS) issue located in the /studentms/admin/contact-us.php endpoint, specifically through the email POST parameter. This allows an attacker to inject and reflect malicious scripts to users interacting with this page. No CVSS score or detailed vendor advisory is available, and no patch or remediation guidance has been provided.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary scripts in the context of the victim's browser session when visiting the vulnerable page. This may lead to session hijacking, defacement, or redirection to malicious sites. However, no known exploits have been reported, and the impact is limited to users interacting with the affected contact-us.php page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and output encoding on the email POST parameter to prevent script injection. Monitor vendor channels for updates regarding patches or official mitigations.