This vulnerability in imvks786 student_management_system up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46 allows remote attackers to perform cross-site scripting by manipulating the name, address, or fname parameters in the /add.php file. The vulnerability enables injection of malicious scripts that could be executed in the context of a victim's browser. The product uses rolling releases, so exact versioning details for affected or patched releases are unavailable. The vendor has been notified but has not issued a fix or advisory. The CVSS 4.0 base score is 5.1, indicating medium severity.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable functionality, potentially leading to session hijacking, defacement, or other client-side impacts. There is no indication of privilege escalation or server-side compromise. The vulnerability requires user interaction and low attack complexity but no privileges. No known exploits in the wild have been reported yet.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, applying input validation or output encoding on the affected parameters (name, address, fname) in /add.php may help mitigate exploitation. Consider restricting access to the vulnerable functionality or employing web application firewalls to detect and block XSS payloads. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.