This vulnerability involves a cross-site scripting issue in the student_management_system_by_php project by raisulislamg4. The flaw exists in an unspecified function within admission_form_check.php, where the Message parameter can be manipulated to inject malicious scripts. The attack vector is network-based, requires low attack complexity, and low privileges with user interaction. The vulnerability does not require scope change or confidentiality, integrity, or availability impacts beyond limited integrity impact. The project was notified early but has not issued a fix or advisory. No patch or remediation guidance is currently available.

Successful exploitation allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts via the Message parameter. This can lead to limited integrity impact such as script execution in the context of the victim user, potentially enabling session hijacking or other client-side attacks. There is no reported impact on confidentiality or availability. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying input validation or output encoding on the Message parameter as a temporary mitigation. Monitor for vendor updates regarding an official patch or fix.