CVE-2025-65136 identifies a reflected XSS vulnerability in the manikandan580 School-management-system version 1.0. The issue occurs in the /studentms/admin/contact-us.php endpoint through the pagedes POST parameter, enabling injection of malicious script code that is reflected in the server response. This vulnerability can potentially be used to execute arbitrary scripts in the context of the victim's browser session. No CVSS score or detailed technical exploit information is provided, and no official remediation or patch is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of a victim's browser session when visiting the vulnerable page. This may lead to session hijacking, defacement, or other client-side attacks. However, there is no indication of active exploitation in the wild or broader impact details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the affected endpoint. Implementing input validation and output encoding on the pagedes parameter is recommended as a mitigation step. Monitor vendor channels for updates regarding patches or official fixes.