CVE-2025-65134 identifies a reflected XSS vulnerability in the manikandan580 School-management-system version 1.0. The issue occurs in the /studentms/admin/contact-us.php endpoint where the email POST parameter is not properly sanitized, allowing injection of malicious scripts. This vulnerability can be exploited by an unauthenticated attacker remotely (network vector) with low attack complexity and no privileges required, but user interaction is necessary. The vulnerability impacts confidentiality and integrity but does not affect availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure or manipulation of data accessible to the user. There is no indication of impact on system availability. The vulnerability affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement input validation and output encoding on the email parameter to prevent script injection. Monitor vendor channels for updates or official patches.